rubygems-update 3.4.21 → 3.5.0

data/bundler/lib/bundler/fetcher.rb

@@ -1,10 +1,10 @@
 # frozen_string_literal: true
 
 require_relative "vendored_persistent"
+require_relative "vendored_timeout"
 require "cgi"
 require "securerandom"
 require "zlib"
-require "rubygems/request"
 
 module Bundler
   # Handles all the fetching with the rubygems server
@@ -81,9 +81,9 @@ module Bundler
                   :HTTPRequestURITooLong, :HTTPUnauthorized, :HTTPUnprocessableEntity,
                   :HTTPUnsupportedMediaType, :HTTPVersionNotSupported].freeze
     FAIL_ERRORS = begin
-      fail_errors = [AuthenticationRequiredError, BadAuthenticationError, AuthenticationForbiddenError, FallbackError]
+      fail_errors = [AuthenticationRequiredError, BadAuthenticationError, AuthenticationForbiddenError, FallbackError, SecurityError]
       fail_errors << Gem::Requirement::BadRequirementError
-      fail_errors.concat(NET_ERRORS.map {|e| Net.const_get(e) })
+      fail_errors.concat(NET_ERRORS.map {|e| Gem::Net.const_get(e) })
     end.freeze
 
     class << self
@@ -95,6 +95,7 @@ module Bundler
     self.max_retries    = Bundler.settings[:retry] # How many retries for the API call
 
     def initialize(remote)
+      @cis = nil
       @remote = remote
 
       Socket.do_not_reverse_lookup = true
@@ -111,14 +112,16 @@ module Bundler
       spec_file_name = "#{spec.join "-"}.gemspec"
 
       uri = Bundler::URI.parse("#{remote_uri}#{Gem::MARSHAL_SPEC_DIR}#{spec_file_name}.rz")
-      if uri.scheme == "file"
-        path = Bundler.rubygems.correct_for_windows_path(uri.path)
+      spec = if uri.scheme == "file"
+        path = Gem::Util.correct_for_windows_path(uri.path)
         Bundler.safe_load_marshal Bundler.rubygems.inflate(Gem.read_binary(path))
       elsif cached_spec_path = gemspec_cached_path(spec_file_name)
         Bundler.load_gemspec(cached_spec_path)
       else
         Bundler.safe_load_marshal Bundler.rubygems.inflate(downloader.fetch(uri).body)
       end
+      raise MarshalError, "is #{spec.inspect}" unless spec.is_a?(Gem::Specification)
+      spec
     rescue MarshalError
       raise HTTPError, "Gemspec #{spec} contained invalid data.\n" \
         "Your network or your gem server is probably having issues right now."
@@ -137,7 +140,9 @@ module Bundler
 
       fetch_specs(gem_names).each do |name, version, platform, dependencies, metadata|
         spec = if dependencies
-          EndpointSpecification.new(name, version, platform, self, dependencies, metadata)
+          EndpointSpecification.new(name, version, platform, self, dependencies, metadata).tap do |es|
+            source.checksum_store.replace(es, es.checksum)
+          end
         else
           RemoteSpecification.new(name, version, platform, self)
         end
@@ -200,6 +205,16 @@ module Bundler
       fetchers.first.api_fetcher?
     end
 
+    def gem_remote_fetcher
+      @gem_remote_fetcher ||= begin
+        require_relative "fetcher/gem_remote_fetcher"
+        fetcher = GemRemoteFetcher.new Gem.configuration[:http_proxy]
+        fetcher.headers["User-Agent"] = user_agent
+        fetcher.headers["X-Gemfile-Source"] = @remote.original_uri.to_s if @remote.original_uri
+        fetcher
+      end
+    end
+
     private
 
     def available_fetchers
@@ -214,7 +229,7 @@ module Bundler
     end
 
     def fetchers
-      @fetchers ||= available_fetchers.map {|f| f.new(downloader, @remote, uri) }.drop_while {|f| !f.available? }
+      @fetchers ||= available_fetchers.map {|f| f.new(downloader, @remote, uri, gem_remote_fetcher) }.drop_while {|f| !f.available? }
     end
 
     def fetch_specs(gem_names)
@@ -228,20 +243,7 @@ module Bundler
     end
 
     def cis
-      env_cis = {
-        "TRAVIS" => "travis",
-        "CIRCLECI" => "circle",
-        "SEMAPHORE" => "semaphore",
-        "JENKINS_URL" => "jenkins",
-        "BUILDBOX" => "buildbox",
-        "GO_SERVER_URL" => "go",
-        "SNAP_CI" => "snap",
-        "GITLAB_CI" => "gitlab",
-        "GITHUB_ACTIONS" => "github",
-        "CI_NAME" => ENV["CI_NAME"],
-        "CI" => "ci",
-      }
-      env_cis.find_all {|env, _| ENV[env] }.map {|_, ci| ci }
+      @cis ||= Bundler::CIDetector.ci_strings
     end
 
     def connection
@@ -251,7 +253,7 @@ module Bundler
                     Bundler.settings[:ssl_client_cert]
         raise SSLError if needs_ssl && !defined?(OpenSSL::SSL)
 
-        con = PersistentHTTP.new :name => "bundler", :proxy => :ENV
+        con = Gem::Net::HTTP::Persistent.new name: "bundler", proxy: :ENV
         if gem_proxy = Gem.configuration[:http_proxy]
           con.proxy = Bundler::URI.parse(gem_proxy) if gem_proxy != :no_proxy
         end
@@ -286,10 +288,10 @@ module Bundler
     end
 
     HTTP_ERRORS = [
-      Timeout::Error, EOFError, SocketError, Errno::ENETDOWN, Errno::ENETUNREACH,
+      Gem::Timeout::Error, EOFError, SocketError, Errno::ENETDOWN, Errno::ENETUNREACH,
       Errno::EINVAL, Errno::ECONNRESET, Errno::ETIMEDOUT, Errno::EAGAIN,
-      Net::HTTPBadResponse, Net::HTTPHeaderSyntaxError, Net::ProtocolError,
-      PersistentHTTP::Error, Zlib::BufError, Errno::EHOSTUNREACH
+      Gem::Net::HTTPBadResponse, Gem::Net::HTTPHeaderSyntaxError, Gem::Net::ProtocolError,
+      Gem::Net::HTTP::Persistent::Error, Zlib::BufError, Errno::EHOSTUNREACH
     ].freeze
 
     def bundler_cert_store
@@ -305,6 +307,7 @@ module Bundler
         end
       else
         store.set_default_paths
+        require "rubygems/request"
         Gem::Request.get_cert_files.each {|c| store.add_file c }
       end
       store

data/bundler/lib/bundler/friendly_errors.rb

@@ -32,7 +32,7 @@ module Bundler
         if Bundler.ui.debug?
           Bundler.ui.trace error
         else
-          Bundler.ui.error error.message, :wrap => true
+          Bundler.ui.error error.message, wrap: true
         end
       when Thor::Error
         Bundler.ui.error error.message
@@ -40,7 +40,7 @@ module Bundler
         Bundler.ui.error "\nQuitting..."
         Bundler.ui.trace error
       when Gem::InvalidSpecificationException
-        Bundler.ui.error error.message, :wrap => true
+        Bundler.ui.error error.message, wrap: true
       when SystemExit
       when *[defined?(Java::JavaLang::OutOfMemoryError) && Java::JavaLang::OutOfMemoryError].compact
         Bundler.ui.error "\nYour JVM has run out of memory, and Bundler cannot continue. " \
@@ -61,7 +61,7 @@ module Bundler
     end
 
     def request_issue_report_for(e)
-      Bundler.ui.error <<-EOS.gsub(/^ {8}/, ""), nil, nil
+      Bundler.ui.error <<~EOS, nil, nil
         --- ERROR REPORT TEMPLATE -------------------------------------------------------
 
         ```
@@ -75,7 +75,7 @@ module Bundler
 
       Bundler.ui.error "Unfortunately, an unexpected error occurred, and Bundler cannot continue."
 
-      Bundler.ui.error <<-EOS.gsub(/^ {8}/, ""), nil, :yellow
+      Bundler.ui.error <<~EOS, nil, :yellow
 
         First, try this link to see if there are any existing issue reports for this error:
         #{issues_url(e)}
@@ -93,7 +93,7 @@ module Bundler
     end
 
     def serialized_exception_for(e)
-      <<-EOS.gsub(/^ {8}/, "")
+      <<~EOS
         #{e.class}: #{e.message}
           #{e.backtrace&.join("\n          ")&.chomp}
       EOS

data/bundler/lib/bundler/gem_helper.rb

@@ -215,7 +215,7 @@ module Bundler
     def sh_with_status(cmd, &block)
       Bundler.ui.debug(cmd)
       SharedHelpers.chdir(base) do
-        outbuf = IO.popen(cmd, :err => [:child, :out], &:read)
+        outbuf = IO.popen(cmd, err: [:child, :out], &:read)
         status = $?
         block&.call(outbuf) if status.success?
         [outbuf, status]

data/bundler/lib/bundler/gem_helpers.rb

@@ -34,6 +34,11 @@ module Bundler
     end
     module_function :local_platform
 
+    def generic_local_platform_is_ruby?
+      generic_local_platform == Gem::Platform::RUBY
+    end
+    module_function :generic_local_platform_is_ruby?
+
     def platform_specificity_match(spec_platform, user_platform)
       spec_platform = Gem::Platform.new(spec_platform)
 
@@ -48,6 +53,13 @@ module Bundler
     end
     module_function :select_best_platform_match
 
+    def force_ruby_platform(specs)
+      matching = specs.select {|spec| spec.match_platform(Gem::Platform::RUBY) && spec.force_ruby_platform! }
+
+      sort_best_platform_match(matching, Gem::Platform::RUBY)
+    end
+    module_function :force_ruby_platform
+
     def sort_best_platform_match(matching, platform)
       exact = matching.select {|spec| spec.platform == platform }
       return exact if exact.any?
@@ -107,8 +119,6 @@ module Bundler
 
     def same_deps(spec, exemplary_spec)
       same_runtime_deps = spec.dependencies.sort == exemplary_spec.dependencies.sort
-      return same_runtime_deps unless spec.is_a?(Gem::Specification) && exemplary_spec.is_a?(Gem::Specification)
-
       same_metadata_deps = spec.required_ruby_version == exemplary_spec.required_ruby_version && spec.required_rubygems_version == exemplary_spec.required_rubygems_version
       same_runtime_deps && same_metadata_deps
     end

data/bundler/lib/bundler/graph.rb

@@ -84,7 +84,7 @@ module Bundler
       else
         raise ArgumentError, "2nd argument is invalid"
       end
-      label.nil? ? {} : { :label => label }
+      label.nil? ? {} : { label: label }
     end
 
     def spec_for_dependency(dependency)
@@ -103,7 +103,7 @@ module Bundler
       end
 
       def g
-        @g ||= ::GraphViz.digraph(@graph_name, :concentrate => true, :normalize => true, :nodesep => 0.55) do |g|
+        @g ||= ::GraphViz.digraph(@graph_name, concentrate: true, normalize: true, nodesep: 0.55) do |g|
           g.edge[:weight]   = 2
           g.edge[:fontname] = g.node[:fontname] = "Arial, Helvetica, SansSerif"
           g.edge[:fontsize] = 12
@@ -114,10 +114,10 @@ module Bundler
         @groups.each do |group|
           g.add_nodes(
             group, {
-              :style => "filled",
-              :fillcolor => "#B9B9D5",
-              :shape => "box3d",
-              :fontsize => 16,
+              style: "filled",
+              fillcolor: "#B9B9D5",
+              shape: "box3d",
+              fontsize: 16,
             }.merge(@node_options[group])
           )
         end
@@ -125,8 +125,8 @@ module Bundler
         @relations.each do |parent, children|
           children.each do |child|
             if @groups.include?(parent)
-              g.add_nodes(child, { :style => "filled", :fillcolor => "#B9B9D5" }.merge(@node_options[child]))
-              g.add_edges(parent, child, { :constraint => false }.merge(@edge_options["#{parent}_#{child}"]))
+              g.add_nodes(child, { style: "filled", fillcolor: "#B9B9D5" }.merge(@node_options[child]))
+              g.add_edges(parent, child, { constraint: false }.merge(@edge_options["#{parent}_#{child}"]))
             else
               g.add_nodes(child, @node_options[child])
               g.add_edges(parent, child, @edge_options["#{parent}_#{child}"])
@@ -135,7 +135,7 @@ module Bundler
         end
 
         if @output_format.to_s == "debug"
-          $stdout.puts g.output :none => String
+          $stdout.puts g.output none: String
           Bundler.ui.info "debugging bundle viz..."
         else
           begin

data/bundler/lib/bundler/index.rb

@@ -145,8 +145,7 @@ module Bundler
     end
 
     # Whether all the specs in self are in other
-    # TODO: rename to #include?
-    def ==(other)
+    def subset?(other)
       all? do |spec|
         other_spec = other[spec].first
         other_spec && dependencies_eql?(spec, other_spec) && spec.source == other_spec.source

data/bundler/lib/bundler/injector.rb

@@ -29,7 +29,7 @@ module Bundler
       end
 
       # temporarily unfreeze
-      Bundler.settings.temporary(:deployment => false, :frozen => false) do
+      Bundler.settings.temporary(deployment: false, frozen: false) do
         # evaluate the Gemfile we have now
         builder = Dsl.new
         builder.eval_gemfile(gemfile_path)

data/bundler/lib/bundler/inline.rb

@@ -48,14 +48,14 @@ def gemfile(install = false, options = {}, &gemfile)
     builder.instance_eval(&gemfile)
     builder.check_primary_source_safety
 
-    Bundler.settings.temporary(:deployment => false, :frozen => false) do
+    Bundler.settings.temporary(deployment: false, frozen: false) do
       definition = builder.to_definition(nil, true)
       def definition.lock(*); end
       definition.validate_runtime!
 
       if install || definition.missing_specs?
-        Bundler.settings.temporary(:inline => true, :no_install => false) do
-          installer = Bundler::Installer.install(Bundler.root, definition, :system => true)
+        Bundler.settings.temporary(inline: true, no_install: false) do
+          installer = Bundler::Installer.install(Bundler.root, definition, system: true)
           installer.post_install_messages.each do |name, message|
             Bundler.ui.info "Post-install message from #{name}:\n#{message}"
           end

data/bundler/lib/bundler/installer/gem_installer.rb

@@ -16,13 +16,13 @@ module Bundler
       post_install_message = install
       Bundler.ui.debug "#{worker}:  #{spec.name} (#{spec.version}) from #{spec.loaded_from}"
       generate_executable_stubs
-      return true, post_install_message
-    rescue Bundler::InstallHookError, Bundler::SecurityError, Bundler::APIResponseMismatchError
+      [true, post_install_message]
+    rescue Bundler::InstallHookError, Bundler::SecurityError, Bundler::APIResponseMismatchError, Bundler::InsecureInstallPathError
       raise
     rescue Errno::ENOSPC
-      return false, out_of_space_message
-    rescue Bundler::BundlerError, Gem::InstallError, Bundler::APIResponseInvalidDependenciesError => e
-      return false, specific_failure_message(e)
+      [false, out_of_space_message]
+    rescue Bundler::BundlerError, Gem::InstallError => e
+      [false, specific_failure_message(e)]
     end
 
     private
@@ -53,10 +53,10 @@ module Bundler
     def install
       spec.source.install(
         spec,
-        :force => force,
-        :ensure_builtin_gems_cached => standalone,
-        :build_args => Array(spec_settings),
-        :previous_spec => previous_spec,
+        force: force,
+        ensure_builtin_gems_cached: standalone,
+        build_args: Array(spec_settings),
+        previous_spec: previous_spec,
       )
     end
 
@@ -77,7 +77,7 @@ module Bundler
       if Bundler.settings[:bin] && standalone
         installer.generate_standalone_bundler_executable_stubs(spec)
       elsif Bundler.settings[:bin]
-        installer.generate_bundler_executable_stubs(spec, :force => true)
+        installer.generate_bundler_executable_stubs(spec, force: true)
       end
     end
   end

data/bundler/lib/bundler/installer/parallel_installer.rb

@@ -42,8 +42,7 @@ module Bundler
 
       # Checks installed dependencies against spec's dependencies to make
       # sure needed dependencies have been installed.
-      def dependencies_installed?(all_specs)
-        installed_specs = all_specs.select(&:installed?).map(&:name)
+      def dependencies_installed?(installed_specs)
         dependencies.all? {|d| installed_specs.include? d.name }
       end
 
@@ -63,20 +62,23 @@ module Bundler
       end
     end
 
-    def self.call(*args)
-      new(*args).call
+    def self.call(*args, **kwargs)
+      new(*args, **kwargs).call
     end
 
     attr_reader :size
 
-    def initialize(installer, all_specs, size, standalone, force)
+    def initialize(installer, all_specs, size, standalone, force, skip: nil)
       @installer = installer
       @size = size
       @standalone = standalone
       @force = force
       @specs = all_specs.map {|s| SpecInstallation.new(s) }
+      @specs.each do |spec_install|
+        spec_install.state = :installed if skip.include?(spec_install.name)
+      end if skip
       @spec_set = all_specs
-      @rake = @specs.find {|s| s.name == "rake" }
+      @rake = @specs.find {|s| s.name == "rake" unless s.installed? }
     end
 
     def call
@@ -183,8 +185,14 @@ module Bundler
     # previously installed specifications. We continue until all specs
     # are installed.
     def enqueue_specs
-      @specs.select(&:ready_to_enqueue?).each do |spec|
-        if spec.dependencies_installed? @specs
+      installed_specs = {}
+      @specs.each do |spec|
+        next unless spec.installed?
+        installed_specs[spec.name] = true
+      end
+
+      @specs.each do |spec|
+        if spec.ready_to_enqueue? && spec.dependencies_installed?(installed_specs)
           spec.state = :enqueued
           worker_pool.enq spec
         end

data/bundler/lib/bundler/installer/standalone.rb

@@ -56,7 +56,7 @@ module Bundler
       if spec.source.instance_of?(Source::Path) && spec.source.path.absolute?
         full_path
       else
-        SharedHelpers.relative_path_to(full_path, :from => Bundler.root.join(bundler_path))
+        SharedHelpers.relative_path_to(full_path, from: Bundler.root.join(bundler_path))
       end
     rescue TypeError
       error_message = "#{spec.name} #{spec.version} has an invalid gemspec"
@@ -101,8 +101,7 @@ module Bundler
       if Gem.respond_to?(:discover_gems_on_require=)
         Gem.discover_gems_on_require = false
       else
-        kernel = (class << ::Kernel; self; end)
-        [kernel, ::Kernel].each do |k|
+        [::Kernel.singleton_class, ::Kernel].each do |k|
           if k.private_method_defined?(:gem_original_require)
             private_require = k.private_method_defined?(:require)
             k.send(:remove_method, :require)

data/bundler/lib/bundler/installer.rb

@@ -136,12 +136,12 @@ module Bundler
 
         mode = Gem.win_platform? ? "wb:UTF-8" : "w"
         require "erb"
-        content = ERB.new(template, :trim_mode => "-").result(binding)
+        content = ERB.new(template, trim_mode: "-").result(binding)
 
-        File.write(binstub_path, content, :mode => mode, :perm => 0o777 & ~File.umask)
+        File.write(binstub_path, content, mode: mode, perm: 0o777 & ~File.umask)
         if Gem.win_platform? || options[:all_platforms]
           prefix = "@ruby -x \"%~f0\" %*\n@exit /b %ERRORLEVEL%\n\n"
-          File.write("#{binstub_path}.cmd", prefix + content, :mode => mode)
+          File.write("#{binstub_path}.cmd", prefix + content, mode: mode)
         end
       end
 
@@ -179,12 +179,12 @@ module Bundler
 
         mode = Gem.win_platform? ? "wb:UTF-8" : "w"
         require "erb"
-        content = ERB.new(template, :trim_mode => "-").result(binding)
+        content = ERB.new(template, trim_mode: "-").result(binding)
 
-        File.write("#{bin_path}/#{executable}", content, :mode => mode, :perm => 0o755)
+        File.write("#{bin_path}/#{executable}", content, mode: mode, perm: 0o755)
         if Gem.win_platform? || options[:all_platforms]
           prefix = "@ruby -x \"%~f0\" %*\n@exit /b %ERRORLEVEL%\n\n"
-          File.write("#{bin_path}/#{executable}.cmd", prefix + content, :mode => mode)
+          File.write("#{bin_path}/#{executable}.cmd", prefix + content, mode: mode)
         end
       end
     end
@@ -214,7 +214,7 @@ module Bundler
     end
 
     def load_plugins
-      Bundler.rubygems.load_plugins
+      Gem.load_plugins
 
       requested_path_gems = @definition.requested_specs.select {|s| s.source.is_a?(Source::Path) }
       path_plugin_files = requested_path_gems.map do |spec|
@@ -223,8 +223,8 @@ module Bundler
         error_message = "#{spec.name} #{spec.version} has an invalid gemspec"
         raise Gem::InvalidSpecificationException, error_message
       end.flatten
-      Bundler.rubygems.load_plugin_files(path_plugin_files)
-      Bundler.rubygems.load_env_plugins
+      Gem.load_plugin_files(path_plugin_files)
+      Gem.load_env_plugins
     end
 
     def ensure_specs_are_compatible!

data/bundler/lib/bundler/lazy_specification.rb

@@ -7,13 +7,23 @@ module Bundler
     include MatchPlatform
     include ForcePlatform
 
-    attr_reader :name, :version, :dependencies, :platform
-    attr_accessor :source, :remote, :force_ruby_platform
+    attr_reader :name, :version, :platform
+    attr_accessor :source, :remote, :force_ruby_platform, :dependencies, :required_ruby_version, :required_rubygems_version
+
+    def self.from_spec(s)
+      lazy_spec = new(s.name, s.version, s.platform, s.source)
+      lazy_spec.dependencies = s.dependencies
+      lazy_spec.required_ruby_version = s.required_ruby_version
+      lazy_spec.required_rubygems_version = s.required_rubygems_version
+      lazy_spec
+    end
 
     def initialize(name, version, platform, source = nil)
       @name          = name
       @version       = version
       @dependencies  = []
+      @required_ruby_version = Gem::Requirement.default
+      @required_rubygems_version = Gem::Requirement.default
       @platform      = platform || Gem::Platform::RUBY
       @source        = source
       @force_ruby_platform = default_force_ruby_platform
@@ -27,6 +37,14 @@ module Bundler
       end
     end
 
+    def lock_name
+      @lock_name ||= name_tuple.lock_name
+    end
+
+    def name_tuple
+      Gem::NameTuple.new(@name, @version, @platform)
+    end
+
     def ==(other)
       full_name == other.full_name
     end
@@ -61,12 +79,7 @@ module Bundler
 
     def to_lock
       out = String.new
-
-      if platform == Gem::Platform::RUBY
-        out << "    #{name} (#{version})\n"
-      else
-        out << "    #{name} (#{version}-#{platform})\n"
-      end
+      out << "    #{lock_name}\n"
 
       dependencies.sort_by(&:to_s).uniq.each do |dep|
         next if dep.type == :development
@@ -89,7 +102,7 @@ module Bundler
 
         installable_candidates = GemHelpers.select_best_platform_match(matching_specs, target_platform)
 
-        specification = __materialize__(installable_candidates, :fallback_to_non_installable => false)
+        specification = __materialize__(installable_candidates, fallback_to_non_installable: false)
         return specification unless specification.nil?
 
         if target_platform != platform
@@ -109,9 +122,7 @@ module Bundler
     # bad gem.
     def __materialize__(candidates, fallback_to_non_installable: Bundler.frozen_bundle?)
       search = candidates.reverse.find do |spec|
-        spec.is_a?(StubSpecification) ||
-          (spec.matches_current_ruby? &&
-            spec.matches_current_rubygems?)
+        spec.is_a?(StubSpecification) || spec.matches_current_metadata?
       end
       if search.nil? && fallback_to_non_installable
         search = candidates.last
@@ -122,11 +133,7 @@ module Bundler
     end
 
     def to_s
-      @to_s ||= if platform == Gem::Platform::RUBY
-        "#{name} (#{version})"
-      else
-        "#{name} (#{version}-#{platform})"
-      end
+      lock_name
     end
 
     def git_version
@@ -134,6 +141,10 @@ module Bundler
       " #{source.revision[0..6]}"
     end
 
+    def force_ruby_platform!
+      @force_ruby_platform = true
+    end
+
     private
 
     def use_exact_resolved_specifications?

data/bundler/lib/bundler/lockfile_generator.rb

@@ -19,6 +19,7 @@ module Bundler
       add_sources
       add_platforms
       add_dependencies
+      add_checksums
       add_locked_ruby_version
       add_bundled_with
 
@@ -65,6 +66,14 @@ module Bundler
       end
     end
 
+    def add_checksums
+      return unless definition.locked_checksums
+      checksums = definition.resolve.map do |spec|
+        spec.source.checksum_store.to_lock(spec)
+      end
+      add_section("CHECKSUMS", checksums)
+    end
+
     def add_locked_ruby_version
       return unless locked_ruby_version = definition.locked_ruby_version
       add_section("RUBY VERSION", locked_ruby_version.to_s)