rubygems-update 3.5.3 → 3.7.1

data/lib/rubygems/gemcutter_utilities.rb

@@ -10,7 +10,8 @@ require_relative "gemcutter_utilities/webauthn_poller"
 
 module Gem::GemcutterUtilities
   ERROR_CODE = 1
-  API_SCOPES = [:index_rubygems, :push_rubygem, :yank_rubygem, :add_owner, :remove_owner, :access_webhooks, :show_dashboard].freeze
+  API_SCOPES = [:index_rubygems, :push_rubygem, :yank_rubygem, :add_owner, :remove_owner, :access_webhooks].freeze
+  EXCLUSIVELY_API_SCOPES = [:show_dashboard].freeze
 
   include Gem::Text
 
@@ -61,6 +62,10 @@ module Gem::GemcutterUtilities
     options[:otp] || ENV["GEM_HOST_OTP_CODE"]
   end
 
+  def webauthn_enabled?
+    options[:webauthn]
+  end
+
   ##
   # The host to connect to either from the RUBYGEMS_HOST environment variable
   # or from the user's configuration
@@ -84,7 +89,7 @@ module Gem::GemcutterUtilities
   # If +allowed_push_host+ metadata is present, then it will only allow that host.
 
   def rubygems_api_request(method, path, host = nil, allowed_push_host = nil, scope: nil, credentials: {}, &block)
-    require_relative "net/http"
+    require_relative "vendored_net_http"
 
     self.host = host if host
     unless self.host
@@ -93,8 +98,8 @@ module Gem::GemcutterUtilities
     end
 
     if allowed_push_host
-      allowed_host_uri = URI.parse(allowed_push_host)
-      host_uri         = URI.parse(self.host)
+      allowed_host_uri = Gem::URI.parse(allowed_push_host)
+      host_uri         = Gem::URI.parse(self.host)
 
       unless (host_uri.scheme == allowed_host_uri.scheme) && (host_uri.host == allowed_host_uri.host)
         alert_error "#{self.host.inspect} is not allowed by the gemspec, which only allows #{allowed_push_host.inspect}"
@@ -102,7 +107,7 @@ module Gem::GemcutterUtilities
       end
     end
 
-    uri = URI.parse "#{self.host}/#{path}"
+    uri = Gem::URI.parse "#{self.host}/#{path}"
     response = request_with_otp(method, uri, &block)
 
     if mfa_unauthorized?(response)
@@ -129,14 +134,13 @@ module Gem::GemcutterUtilities
 
     say "The existing key doesn't have access of #{scope} on #{pretty_host}. Please sign in to update access."
 
-    email    = ask "   Email: "
-    password = ask_for_password "Password: "
+    identifier = ask "Username/email: "
+    password   = ask_for_password "      Password: "
 
     response = rubygems_api_request(:put, "api/v1/api_key",
                                     sign_in_host, scope: scope) do |request|
-      request.basic_auth email, password
-      request["OTP"] = otp if otp
-      request.body = URI.encode_www_form({ api_key: api_key }.merge(update_scope_params))
+      request.basic_auth identifier, password
+      request.body = Gem::URI.encode_www_form({ api_key: api_key }.merge(update_scope_params))
     end
 
     with_response response do |_resp|
@@ -158,25 +162,24 @@ module Gem::GemcutterUtilities
     say "Don't have an account yet? " \
         "Create one at #{sign_in_host}/sign_up"
 
-    email = ask "   Email: "
-    password = ask_for_password "Password: "
+    identifier = ask "Username/email: "
+    password   = ask_for_password "      Password: "
     say "\n"
 
     key_name     = get_key_name(scope)
     scope_params = get_scope_params(scope)
-    profile      = get_user_profile(email, password)
+    profile      = get_user_profile(identifier, password)
     mfa_params   = get_mfa_params(profile)
     all_params   = scope_params.merge(mfa_params)
     warning      = profile["warning"]
-    credentials  = { email: email, password: password }
+    credentials  = { identifier: identifier, password: password }
 
     say "#{warning}\n" if warning
 
     response = rubygems_api_request(:post, "api/v1/api_key",
                                     sign_in_host, credentials: credentials, scope: scope) do |request|
-      request.basic_auth email, password
-      request["OTP"] = otp if otp
-      request.body = URI.encode_www_form({ name: key_name }.merge(all_params))
+      request.basic_auth identifier, password
+      request.body = Gem::URI.encode_www_form({ name: key_name }.merge(all_params))
     end
 
     with_response response do |resp|
@@ -250,6 +253,8 @@ module Gem::GemcutterUtilities
       req["OTP"] = otp if otp
       block.call(req)
     end
+  ensure
+    options[:otp] = nil if webauthn_enabled?
   end
 
   def fetch_otp(credentials)
@@ -258,7 +263,10 @@ module Gem::GemcutterUtilities
       port = server.addr[1].to_s
 
       url_with_port = "#{webauthn_url}?port=#{port}"
-      say "You have enabled multi-factor authentication. Please visit #{url_with_port} to authenticate via security device. If you can't verify using WebAuthn but have OTP enabled, you can re-run the gem signin command with the `--otp [your_code]` option."
+      say "You have enabled multi-factor authentication. Please visit the following URL to authenticate via security device. If you can't verify using WebAuthn but have OTP enabled, you can re-run the gem signin command with the `--otp [your_code]` option."
+      say ""
+      say url_with_port
+      say ""
 
       threads = [WebauthnListener.listener_thread(host, server), WebauthnPoller.poll_thread(options, host, webauthn_url, credentials)]
       otp_thread = wait_for_otp_thread(*threads)
@@ -270,6 +278,8 @@ module Gem::GemcutterUtilities
         terminate_interaction(1)
       end
 
+      options[:webauthn] = true
+
       say "You are verified with a security device. You may close the browser window."
       otp_thread[:otp]
     else
@@ -294,7 +304,7 @@ module Gem::GemcutterUtilities
       if credentials.empty?
         request.add_field "Authorization", api_key
       else
-        request.basic_auth credentials[:email], credentials[:password]
+        request.basic_auth credentials[:identifier], credentials[:password]
       end
     end
     response.is_a?(Gem::Net::HTTPSuccess) ? response.body : nil
@@ -309,15 +319,31 @@ module Gem::GemcutterUtilities
   end
 
   def get_scope_params(scope)
-    scope_params = {}
+    scope_params = { index_rubygems: true, push_rubygem: true }
 
     if scope
       scope_params = { scope => true }
     else
-      say "Please select scopes you want to enable for the API key (y/n)"
-      API_SCOPES.each do |s|
-        selected = ask_yes_no(s.to_s, false)
-        scope_params[s] = true if selected
+      say "The default access scope is:"
+      scope_params.each do |k, _v|
+        say "  #{k}: y"
+      end
+      say "\n"
+      customise = ask_yes_no("Do you want to customise scopes?", false)
+      if customise
+        EXCLUSIVELY_API_SCOPES.each do |excl_scope|
+          selected = ask_yes_no("#{excl_scope} (exclusive scope, answering yes will not prompt for other scopes)", false)
+          next unless selected
+
+          return { excl_scope => true }
+        end
+
+        scope_params = {}
+
+        API_SCOPES.each do |s|
+          selected = ask_yes_no(s.to_s, false)
+          scope_params[s] = true if selected
+        end
       end
       say "\n"
     end
@@ -329,11 +355,11 @@ module Gem::GemcutterUtilities
     host == Gem::DEFAULT_HOST
   end
 
-  def get_user_profile(email, password)
+  def get_user_profile(identifier, password)
     return {} unless default_host?
 
     response = rubygems_api_request(:get, "api/v1/profile/me.yaml") do |request|
-      request.basic_auth email, password
+      request.basic_auth identifier, password
     end
 
     with_response response do |resp|

data/lib/rubygems/gemspec_helpers.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+require_relative "../rubygems"
+
+##
+# Mixin methods for commands that work with gemspecs.
+
+module Gem::GemspecHelpers
+  def find_gemspec(glob = "*.gemspec")
+    gemspecs = Dir.glob(glob).sort
+
+    if gemspecs.size > 1
+      alert_error "Multiple gemspecs found: #{gemspecs}, please specify one"
+      terminate_interaction(1)
+    end
+
+    gemspecs.first
+  end
+end

data/lib/rubygems/install_update_options.rb

@@ -179,6 +179,11 @@ module Gem::InstallUpdateOptions
                "Suggest alternates when gems are not found") do |v,_o|
       options[:suggest_alternate] = v
     end
+
+    add_option(:"Install/Update", "--target-rbconfig [FILE]",
+                "rbconfig.rb for the deployment target platform") do |v, _o|
+      Gem.set_target_rbconfig(v)
+    end
   end
 
   ##

data/lib/rubygems/installer.rb

@@ -66,8 +66,6 @@ class Gem::Installer
 
   attr_reader :package
 
-  @path_warning = false
-
   class << self
     #
     # Changes in rubygems to lazily loading `rubygems/command` (in order to
@@ -86,11 +84,6 @@ class Gem::Installer
       super(klass)
     end
 
-    ##
-    # True if we've warned about PATH not including Gem.bindir
-
-    attr_accessor :path_warning
-
     ##
     # Overrides the executable format.
     #
@@ -188,15 +181,6 @@ class Gem::Installer
     @package.dir_mode = options[:dir_mode]
     @package.prog_mode = options[:prog_mode]
     @package.data_mode = options[:data_mode]
-
-    if @gem_home == Gem.user_dir
-      # If we get here, then one of the following likely happened:
-      # - `--user-install` was specified
-      # - `Gem::PathSupport#home` fell back to `Gem.user_dir`
-      # - GEM_HOME was manually set to `Gem.user_dir`
-
-      check_that_user_bin_dir_is_in_path
-    end
   end
 
   ##
@@ -244,8 +228,7 @@ class Gem::Installer
       ruby_executable = true
       existing = io.read.slice(/
           ^\s*(
-            gem \s |
-            load \s Gem\.bin_path\( |
+            Gem\.activate_and_load_bin_path\( |
             load \s Gem\.activate_bin_path\(
           )
           (['"])(.*?)(\2),
@@ -344,7 +327,7 @@ class Gem::Installer
 
     say spec.post_install_message if options[:post_install_message] && !spec.post_install_message.nil?
 
-    Gem::Specification.add_spec(spec)
+    Gem::Specification.add_spec(spec) unless @install_dir
 
     load_plugin
 
@@ -488,11 +471,21 @@ class Gem::Installer
   end
 
   def generate_bin # :nodoc:
-    return if spec.executables.nil? || spec.executables.empty?
+    executables = spec.executables
+    return if executables.nil? || executables.empty?
+
+    if @gem_home == Gem.user_dir
+      # If we get here, then one of the following likely happened:
+      # - `--user-install` was specified
+      # - `Gem::PathSupport#home` fell back to `Gem.user_dir`
+      # - GEM_HOME was manually set to `Gem.user_dir`
+
+      check_that_user_bin_dir_is_in_path(executables)
+    end
 
     ensure_writable_dir @bin_dir
 
-    spec.executables.each do |filename|
+    executables.each do |filename|
       bin_path = File.join gem_dir, spec.bindir, filename
       next unless File.exist? bin_path
 
@@ -500,8 +493,7 @@ class Gem::Installer
       dir_mode = options[:prog_mode] || (mode | 0o111)
 
       unless dir_mode == mode
-        require "fileutils"
-        FileUtils.chmod dir_mode, bin_path
+        File.chmod dir_mode, bin_path
       end
 
       check_executable_overwrite filename
@@ -539,12 +531,14 @@ class Gem::Installer
   def generate_bin_script(filename, bindir)
     bin_script_path = File.join bindir, formatted_program_filename(filename)
 
-    require "fileutils"
-    FileUtils.rm_f bin_script_path # prior install may have been --no-wrappers
+    Gem.open_file_with_lock(bin_script_path) do
+      require "fileutils"
+      FileUtils.rm_f bin_script_path # prior install may have been --no-wrappers
 
-    File.open bin_script_path, "wb", 0o755 do |file|
-      file.print app_script_text(filename)
-      file.chmod(options[:prog_mode] || 0o755)
+      File.open(bin_script_path, "wb", 0o755) do |file|
+        file.write app_script_text(filename)
+        file.chmod(options[:prog_mode] || 0o755)
+      end
     end
 
     verbose bin_script_path
@@ -693,9 +687,7 @@ class Gem::Installer
     end
   end
 
-  def check_that_user_bin_dir_is_in_path # :nodoc:
-    return if self.class.path_warning
-
+  def check_that_user_bin_dir_is_in_path(executables) # :nodoc:
     user_bin_dir = @bin_dir || Gem.bindir(gem_home)
     user_bin_dir = user_bin_dir.tr(File::ALT_SEPARATOR, File::SEPARATOR) if File::ALT_SEPARATOR
 
@@ -711,8 +703,7 @@ class Gem::Installer
 
     unless path.include? user_bin_dir
       unless !Gem.win_platform? && (path.include? user_bin_dir.sub(ENV["HOME"], "~"))
-        alert_warning "You don't have #{user_bin_dir} in your PATH,\n\t  gem executables will not run."
-        self.class.path_warning = true
+        alert_warning "You don't have #{user_bin_dir} in your PATH,\n\t  gem executables (#{executables.join(", ")}) will not run."
       end
     end
   end
@@ -757,54 +748,53 @@ class Gem::Installer
   def app_script_text(bin_file_name)
     # NOTE: that the `load` lines cannot be indented, as old RG versions match
     # against the beginning of the line
-    <<-TEXT
-#{shebang bin_file_name}
-#
-# This file was generated by RubyGems.
-#
-# The application '#{spec.name}' is installed as part of a gem, and
-# this file is here to facilitate running it.
-#
-
-require 'rubygems'
-#{gemdeps_load(spec.name)}
-version = "#{Gem::Requirement.default_prerelease}"
-
-str = ARGV.first
-if str
-  str = str.b[/\\A_(.*)_\\z/, 1]
-  if str and Gem::Version.correct?(str)
-    #{explicit_version_requirement(spec.name)}
-    ARGV.shift
-  end
-end
+    <<~TEXT
+      #{shebang bin_file_name}
+      #
+      # This file was generated by RubyGems.
+      #
+      # The application '#{spec.name}' is installed as part of a gem, and
+      # this file is here to facilitate running it.
+      #
+
+      require 'rubygems'
+      #{gemdeps_load(spec.name)}
+      version = "#{Gem::Requirement.default_prerelease}"
+
+      str = ARGV.first
+      if str
+        str = str.b[/\\A_(.*)_\\z/, 1]
+        if str and Gem::Version.correct?(str)
+          #{explicit_version_requirement(spec.name)}
+          ARGV.shift
+        end
+      end
 
-if Gem.respond_to?(:activate_bin_path)
-load Gem.activate_bin_path('#{spec.name}', '#{bin_file_name}', version)
-else
-gem #{spec.name.dump}, version
-load Gem.bin_path(#{spec.name.dump}, #{bin_file_name.dump}, version)
-end
-TEXT
+      if Gem.respond_to?(:activate_and_load_bin_path)
+        Gem.activate_and_load_bin_path('#{spec.name}', '#{bin_file_name}', version)
+      else
+        load Gem.activate_bin_path('#{spec.name}', '#{bin_file_name}', version)
+      end
+    TEXT
   end
 
   def gemdeps_load(name)
     return "" if name == "bundler"
 
-    <<-TEXT
+    <<~TEXT
 
-Gem.use_gemdeps
-TEXT
+      Gem.use_gemdeps
+    TEXT
   end
 
   def explicit_version_requirement(name)
     code = "version = str"
     return code unless name == "bundler"
 
-    code += <<-TEXT
+    code += <<~TEXT
 
-    ENV['BUNDLER_VERSION'] = str
-TEXT
+      ENV['BUNDLER_VERSION'] = str
+    TEXT
   end
 
   ##
@@ -819,9 +809,9 @@ TEXT
 
     if File.exist?(File.join(bindir, ruby_exe))
       # stub & ruby.exe within same folder.  Portable
-      <<-TEXT
-@ECHO OFF
-@"%~dp0#{ruby_exe}" "%~dpn0" %*
+      <<~TEXT
+        @ECHO OFF
+        @"%~dp0#{ruby_exe}" "%~dpn0" %*
       TEXT
     elsif bindir.downcase.start_with? rb_topdir.downcase
       # stub within ruby folder, but not standard bin.  Portable
@@ -829,16 +819,16 @@ TEXT
       from = Pathname.new bindir
       to   = Pathname.new "#{rb_topdir}/bin"
       rel  = to.relative_path_from from
-      <<-TEXT
-@ECHO OFF
-@"%~dp0#{rel}/#{ruby_exe}" "%~dpn0" %*
+      <<~TEXT
+        @ECHO OFF
+        @"%~dp0#{rel}/#{ruby_exe}" "%~dpn0" %*
       TEXT
     else
       # outside ruby folder, maybe -user-install or bundler.  Portable, but ruby
       # is dependent on PATH
-      <<-TEXT
-@ECHO OFF
-@#{ruby_exe} "%~dpn0" %*
+      <<~TEXT
+        @ECHO OFF
+        @#{ruby_exe} "%~dpn0" %*
       TEXT
     end
   end
@@ -847,7 +837,7 @@ TEXT
   # configure scripts and rakefiles or mkrf_conf files.
 
   def build_extensions
-    builder = Gem::Ext::Builder.new spec, build_args
+    builder = Gem::Ext::Builder.new spec, build_args, Gem.target_rbconfig
 
     builder.build_extensions
   end
@@ -961,11 +951,8 @@ TEXT
   end
 
   def ensure_writable_dir(dir) # :nodoc:
-    begin
-      Dir.mkdir dir, *[options[:dir_mode] && 0o755].compact
-    rescue SystemCallError
-      raise unless File.directory? dir
-    end
+    require "fileutils"
+    FileUtils.mkdir_p dir, mode: options[:dir_mode] && 0o755
 
     raise Gem::FilePermissionError.new(dir) unless File.writable? dir
   end
@@ -993,7 +980,7 @@ TEXT
   end
 
   def rb_config
-    RbConfig::CONFIG
+    Gem.target_rbconfig
   end
 
   def ruby_install_name
@@ -1006,18 +993,17 @@ TEXT
 
   def bash_prolog_script
     if load_relative_enabled?
-      script = +<<~EOS
-        bindir="${0%/*}"
-      EOS
-
-      script << %(exec "$bindir/#{ruby_install_name}" "-x" "$0" "$@"\n)
-
       <<~EOS
         #!/bin/sh
         # -*- ruby -*-
         _=_\\
         =begin
-        #{script.chomp}
+        bindir="${0%/*}"
+        ruby="$bindir/#{ruby_install_name}"
+        if [ ! -f "$ruby" ]; then
+          ruby="#{ruby_install_name}"
+        fi
+        exec "$ruby" "-x" "$0" "$@"
         =end
       EOS
     else

data/lib/rubygems/local_remote_options.rb

@@ -6,7 +6,7 @@
 # See LICENSE.txt for permissions.
 #++
 
-require "uri"
+require_relative "vendor/uri/lib/uri"
 require_relative "../rubygems"
 
 ##
@@ -17,10 +17,10 @@ module Gem::LocalRemoteOptions
   # Allows Gem::OptionParser to handle HTTP URIs.
 
   def accept_uri_http
-    Gem::OptionParser.accept URI::HTTP do |value|
+    Gem::OptionParser.accept Gem::URI::HTTP do |value|
       begin
-        uri = URI.parse value
-      rescue URI::InvalidURIError
+        uri = Gem::URI.parse value
+      rescue Gem::URI::InvalidURIError
         raise Gem::OptionParser::InvalidArgument, value
       end
 
@@ -88,7 +88,7 @@ module Gem::LocalRemoteOptions
   def add_proxy_option
     accept_uri_http
 
-    add_option(:"Local/Remote", "-p", "--[no-]http-proxy [URL]", URI::HTTP,
+    add_option(:"Local/Remote", "-p", "--[no-]http-proxy [URL]", Gem::URI::HTTP,
                "Use HTTP proxy for remote operations") do |value, options|
       options[:http_proxy] = value == false ? :no_proxy : value
       Gem.configuration[:http_proxy] = options[:http_proxy]
@@ -101,7 +101,7 @@ module Gem::LocalRemoteOptions
   def add_source_option
     accept_uri_http
 
-    add_option(:"Local/Remote", "-s", "--source URL", URI::HTTP,
+    add_option(:"Local/Remote", "-s", "--source URL", Gem::URI::HTTP,
                "Append URL to list of remote gem sources") do |source, options|
       source << "/" unless source.end_with?("/")
 
@@ -134,13 +134,13 @@ module Gem::LocalRemoteOptions
   # Is local fetching enabled?
 
   def local?
-    options[:domain] == :local || options[:domain] == :both
+    [:local, :both].include?(options[:domain])
   end
 
   ##
   # Is remote fetching enabled?
 
   def remote?
-    options[:domain] == :remote || options[:domain] == :both
+    [:remote, :both].include?(options[:domain])
   end
 end

data/lib/rubygems/package/tar_header.rb

@@ -95,14 +95,14 @@ class Gem::Package::TarHeader
 
   attr_reader(*FIELDS)
 
-  EMPTY_HEADER = ("\0" * 512).freeze # :nodoc:
+  EMPTY_HEADER = ("\0" * 512).b.freeze # :nodoc:
 
   ##
   # Creates a tar header from IO +stream+
 
   def self.from(stream)
     header = stream.read 512
-    empty = (header == EMPTY_HEADER)
+    return EMPTY if header == EMPTY_HEADER
 
     fields = header.unpack UNPACK_FORMAT
 
@@ -123,7 +123,7 @@ class Gem::Package::TarHeader
         devminor: strict_oct(fields.shift),
         prefix: fields.shift,
 
-        empty: empty
+        empty: false
   end
 
   def self.strict_oct(str)
@@ -172,6 +172,22 @@ class Gem::Package::TarHeader
     @empty = vals[:empty]
   end
 
+  EMPTY = new({ # :nodoc:
+    checksum: 0,
+    gname: "",
+    linkname: "",
+    magic: "",
+    mode: 0,
+    name: "",
+    prefix: "",
+    size: 0,
+    uname: "",
+    version: 0,
+
+    empty: true,
+  }).freeze
+  private_constant :EMPTY
+
   ##
   # Is the tar entry empty?
 
@@ -212,6 +228,17 @@ class Gem::Package::TarHeader
     @checksum = oct calculate_checksum(header), 6
   end
 
+  ##
+  # Header's full name, including prefix
+
+  def full_name
+    if prefix != ""
+      File.join prefix, name
+    else
+      name
+    end
+  end
+
   private
 
   def calculate_checksum(header)
@@ -241,7 +268,7 @@ class Gem::Package::TarHeader
 
     header = header.pack PACK_FORMAT
 
-    header << ("\0" * ((512 - header.size) % 512))
+    header.ljust 512, "\0"
   end
 
   def oct(num, len)

data/lib/rubygems/package/tar_reader/entry.rb

@@ -87,11 +87,7 @@ class Gem::Package::TarReader::Entry
   # Full name of the tar entry
 
   def full_name
-    if @header.prefix != ""
-      File.join @header.prefix, @header.name
-    else
-      @header.name
-    end
+    @header.full_name.force_encoding(Encoding::UTF_8)
   rescue ArgumentError => e
     raise unless e.message == "string contains null byte"
     raise Gem::Package::TarInvalidError,