rubygems-update 3.5.6 → 3.5.16

data/lib/rubygems/dependency.rb

@@ -271,15 +271,7 @@ class Gem::Dependency
   end
 
   def matching_specs(platform_only = false)
-    env_req = Gem.env_requirement(name)
-    matches = Gem::Specification.stubs_for(name).find_all do |spec|
-      requirement.satisfied_by?(spec.version) && env_req.satisfied_by?(spec.version)
-    end.map(&:to_spec)
-
-    if prioritizes_bundler?
-      require_relative "bundler_version_finder"
-      Gem::BundlerVersionFinder.prioritize!(matches)
-    end
+    matches = Gem::Specification.find_all_by_name(name, requirement)
 
     if platform_only
       matches.reject! do |spec|
@@ -297,10 +289,6 @@ class Gem::Dependency
     @requirement.specific?
   end
 
-  def prioritizes_bundler?
-    name == "bundler" && !specific?
-  end
-
   def to_specs
     matches = matching_specs true
 
@@ -328,9 +316,9 @@ class Gem::Dependency
     return active if active
 
     unless prerelease?
-      # Move prereleases to the end of the list for >= 0 requirements
+      # Consider prereleases only as a fallback
       pre, matches = matches.partition {|spec| spec.version.prerelease? }
-      matches += pre if requirement == Gem::Requirement.default
+      matches = pre if matches.empty?
     end
 
     matches.first

data/lib/rubygems/dependency_list.rb

@@ -6,7 +6,7 @@
 # See LICENSE.txt for permissions.
 #++
 
-require_relative "tsort"
+require_relative "vendored_tsort"
 require_relative "deprecate"
 
 ##

data/lib/rubygems/deprecate.rb

@@ -69,99 +69,101 @@
 #       end
 #     end
 
-module Gem::Deprecate
-  def self.skip # :nodoc:
-    @skip ||= false
-  end
+module Gem
+  module Deprecate
+    def self.skip # :nodoc:
+      @skip ||= false
+    end
 
-  def self.skip=(v) # :nodoc:
-    @skip = v
-  end
+    def self.skip=(v) # :nodoc:
+      @skip = v
+    end
 
-  ##
-  # Temporarily turn off warnings. Intended for tests only.
+    ##
+    # Temporarily turn off warnings. Intended for tests only.
 
-  def skip_during
-    original = Gem::Deprecate.skip
-    Gem::Deprecate.skip = true
-    yield
-  ensure
-    Gem::Deprecate.skip = original
-  end
+    def skip_during
+      original = Gem::Deprecate.skip
+      Gem::Deprecate.skip = true
+      yield
+    ensure
+      Gem::Deprecate.skip = original
+    end
 
-  def self.next_rubygems_major_version # :nodoc:
-    Gem::Version.new(Gem.rubygems_version.segments.first).bump
-  end
+    def self.next_rubygems_major_version # :nodoc:
+      Gem::Version.new(Gem.rubygems_version.segments.first).bump
+    end
 
-  ##
-  # Simple deprecation method that deprecates +name+ by wrapping it up
-  # in a dummy method. It warns on each call to the dummy method
-  # telling the user of +repl+ (unless +repl+ is :none) and the
-  # year/month that it is planned to go away.
+    ##
+    # Simple deprecation method that deprecates +name+ by wrapping it up
+    # in a dummy method. It warns on each call to the dummy method
+    # telling the user of +repl+ (unless +repl+ is :none) and the
+    # year/month that it is planned to go away.
 
-  def deprecate(name, repl, year, month)
-    class_eval do
-      old = "_deprecated_#{name}"
-      alias_method old, name
-      define_method name do |*args, &block|
-        klass = is_a? Module
-        target = klass ? "#{self}." : "#{self.class}#"
-        msg = [
-          "NOTE: #{target}#{name} is deprecated",
-          repl == :none ? " with no replacement" : "; use #{repl} instead",
-          format(". It will be removed on or after %4d-%02d.", year, month),
-          "\n#{target}#{name} called from #{Gem.location_of_caller.join(":")}",
-        ]
-        warn "#{msg.join}." unless Gem::Deprecate.skip
-        send old, *args, &block
+    def deprecate(name, repl, year, month)
+      class_eval do
+        old = "_deprecated_#{name}"
+        alias_method old, name
+        define_method name do |*args, &block|
+          klass = is_a? Module
+          target = klass ? "#{self}." : "#{self.class}#"
+          msg = [
+            "NOTE: #{target}#{name} is deprecated",
+            repl == :none ? " with no replacement" : "; use #{repl} instead",
+            format(". It will be removed on or after %4d-%02d.", year, month),
+            "\n#{target}#{name} called from #{Gem.location_of_caller.join(":")}",
+          ]
+          warn "#{msg.join}." unless Gem::Deprecate.skip
+          send old, *args, &block
+        end
+        ruby2_keywords name if respond_to?(:ruby2_keywords, true)
       end
-      ruby2_keywords name if respond_to?(:ruby2_keywords, true)
     end
-  end
 
-  ##
-  # Simple deprecation method that deprecates +name+ by wrapping it up
-  # in a dummy method. It warns on each call to the dummy method
-  # telling the user of +repl+ (unless +repl+ is :none) and the
-  # Rubygems version that it is planned to go away.
+    ##
+    # Simple deprecation method that deprecates +name+ by wrapping it up
+    # in a dummy method. It warns on each call to the dummy method
+    # telling the user of +repl+ (unless +repl+ is :none) and the
+    # Rubygems version that it is planned to go away.
 
-  def rubygems_deprecate(name, replacement=:none)
-    class_eval do
-      old = "_deprecated_#{name}"
-      alias_method old, name
-      define_method name do |*args, &block|
-        klass = is_a? Module
-        target = klass ? "#{self}." : "#{self.class}#"
-        msg = [
-          "NOTE: #{target}#{name} is deprecated",
-          replacement == :none ? " with no replacement" : "; use #{replacement} instead",
-          ". It will be removed in Rubygems #{Gem::Deprecate.next_rubygems_major_version}",
-          "\n#{target}#{name} called from #{Gem.location_of_caller.join(":")}",
-        ]
-        warn "#{msg.join}." unless Gem::Deprecate.skip
-        send old, *args, &block
+    def rubygems_deprecate(name, replacement=:none)
+      class_eval do
+        old = "_deprecated_#{name}"
+        alias_method old, name
+        define_method name do |*args, &block|
+          klass = is_a? Module
+          target = klass ? "#{self}." : "#{self.class}#"
+          msg = [
+            "NOTE: #{target}#{name} is deprecated",
+            replacement == :none ? " with no replacement" : "; use #{replacement} instead",
+            ". It will be removed in Rubygems #{Gem::Deprecate.next_rubygems_major_version}",
+            "\n#{target}#{name} called from #{Gem.location_of_caller.join(":")}",
+          ]
+          warn "#{msg.join}." unless Gem::Deprecate.skip
+          send old, *args, &block
+        end
+        ruby2_keywords name if respond_to?(:ruby2_keywords, true)
       end
-      ruby2_keywords name if respond_to?(:ruby2_keywords, true)
     end
-  end
 
-  # Deprecation method to deprecate Rubygems commands
-  def rubygems_deprecate_command(version = Gem::Deprecate.next_rubygems_major_version)
-    class_eval do
-      define_method "deprecated?" do
-        true
-      end
+    # Deprecation method to deprecate Rubygems commands
+    def rubygems_deprecate_command(version = Gem::Deprecate.next_rubygems_major_version)
+      class_eval do
+        define_method "deprecated?" do
+          true
+        end
 
-      define_method "deprecation_warning" do
-        msg = [
-          "#{command} command is deprecated",
-          ". It will be removed in Rubygems #{version}.\n",
-        ]
+        define_method "deprecation_warning" do
+          msg = [
+            "#{command} command is deprecated",
+            ". It will be removed in Rubygems #{version}.\n",
+          ]
 
-        alert_warning msg.join.to_s unless Gem::Deprecate.skip
+          alert_warning msg.join.to_s unless Gem::Deprecate.skip
+        end
       end
     end
-  end
 
-  module_function :rubygems_deprecate, :rubygems_deprecate_command, :skip_during
+    module_function :rubygems_deprecate, :rubygems_deprecate_command, :skip_during
+  end
 end

data/lib/rubygems/ext/cargo_builder.rb

@@ -185,6 +185,7 @@ class Gem::Ext::CargoBuilder < Gem::Ext::Builder
   end
 
   def cargo_dylib_path(dest_path, crate_name)
+    so_ext = RbConfig::CONFIG["SOEXT"]
     prefix = so_ext == "dll" ? "" : "lib"
     path_parts = [dest_path]
     path_parts << ENV["CARGO_BUILD_TARGET"] if ENV["CARGO_BUILD_TARGET"]
@@ -293,7 +294,7 @@ EOF
 
     case var_name
     # On windows, it is assumed that mkmf has setup an exports file for the
-    # extension, so we have to to create one ourselves.
+    # extension, so we have to create one ourselves.
     when "DEFFILE"
       write_deffile(dest_dir, crate_name)
     else
@@ -313,22 +314,6 @@ EOF
     deffile_path
   end
 
-  # We have to basically reimplement <code>RbConfig::CONFIG['SOEXT']</code> here to support
-  # Ruby < 2.5
-  #
-  # @see https://github.com/ruby/ruby/blob/c87c027f18c005460746a74c07cd80ee355b16e4/configure.ac#L3185
-  def so_ext
-    return RbConfig::CONFIG["SOEXT"] if RbConfig::CONFIG.key?("SOEXT")
-
-    if win_target?
-      "dll"
-    elsif darwin_target?
-      "dylib"
-    else
-      "so"
-    end
-  end
-
   # Corresponds to $(LIBPATH) in mkmf
   def mkmf_libpath
     ["-L", "native=#{makefile_config("libdir")}"]

data/lib/rubygems/gemcutter_utilities/webauthn_poller.rb

@@ -69,8 +69,10 @@ module Gem::GemcutterUtilities
       rubygems_api_request(:get, "api/v1/webauthn_verification/#{webauthn_token}/status.json") do |request|
         if credentials.empty?
           request.add_field "Authorization", api_key
+        elsif credentials[:identifier] && credentials[:password]
+          request.basic_auth credentials[:identifier], credentials[:password]
         else
-          request.basic_auth credentials[:email], credentials[:password]
+          raise Gem::WebauthnVerificationError, "Provided missing credentials"
         end
       end
     end

data/lib/rubygems/gemcutter_utilities.rb

@@ -85,7 +85,7 @@ module Gem::GemcutterUtilities
   # If +allowed_push_host+ metadata is present, then it will only allow that host.
 
   def rubygems_api_request(method, path, host = nil, allowed_push_host = nil, scope: nil, credentials: {}, &block)
-    require_relative "net/http"
+    require_relative "vendored_net_http"
 
     self.host = host if host
     unless self.host

data/lib/rubygems/gemspec_helpers.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+require_relative "../rubygems"
+
+##
+# Mixin methods for commands that work with gemspecs.
+
+module Gem::GemspecHelpers
+  def find_gemspec(glob = "*.gemspec")
+    gemspecs = Dir.glob(glob).sort
+
+    if gemspecs.size > 1
+      alert_error "Multiple gemspecs found: #{gemspecs}, please specify one"
+      terminate_interaction(1)
+    end
+
+    gemspecs.first
+  end
+end

data/lib/rubygems/installer.rb

@@ -344,7 +344,7 @@ class Gem::Installer
 
     say spec.post_install_message if options[:post_install_message] && !spec.post_install_message.nil?
 
-    Gem::Specification.add_spec(spec)
+    Gem::Specification.add_spec(spec) unless @install_dir
 
     load_plugin
 
@@ -500,8 +500,7 @@ class Gem::Installer
       dir_mode = options[:prog_mode] || (mode | 0o111)
 
       unless dir_mode == mode
-        require "fileutils"
-        FileUtils.chmod dir_mode, bin_path
+        File.chmod dir_mode, bin_path
       end
 
       check_executable_overwrite filename
@@ -539,12 +538,14 @@ class Gem::Installer
   def generate_bin_script(filename, bindir)
     bin_script_path = File.join bindir, formatted_program_filename(filename)
 
-    require "fileutils"
-    FileUtils.rm_f bin_script_path # prior install may have been --no-wrappers
+    Gem.open_file_with_flock("#{bin_script_path}.lock") do
+      require "fileutils"
+      FileUtils.rm_f bin_script_path # prior install may have been --no-wrappers
 
-    File.open bin_script_path, "wb", 0o755 do |file|
-      file.print app_script_text(filename)
-      file.chmod(options[:prog_mode] || 0o755)
+      File.open(bin_script_path, "wb", 0o755) do |file|
+        file.write app_script_text(filename)
+        file.chmod(options[:prog_mode] || 0o755)
+      end
     end
 
     verbose bin_script_path

data/lib/rubygems/package/tar_header.rb

@@ -95,14 +95,14 @@ class Gem::Package::TarHeader
 
   attr_reader(*FIELDS)
 
-  EMPTY_HEADER = ("\0" * 512).freeze # :nodoc:
+  EMPTY_HEADER = ("\0" * 512).b.freeze # :nodoc:
 
   ##
   # Creates a tar header from IO +stream+
 
   def self.from(stream)
     header = stream.read 512
-    empty = (header == EMPTY_HEADER)
+    return EMPTY if header == EMPTY_HEADER
 
     fields = header.unpack UNPACK_FORMAT
 
@@ -123,7 +123,7 @@ class Gem::Package::TarHeader
         devminor: strict_oct(fields.shift),
         prefix: fields.shift,
 
-        empty: empty
+        empty: false
   end
 
   def self.strict_oct(str)
@@ -172,6 +172,22 @@ class Gem::Package::TarHeader
     @empty = vals[:empty]
   end
 
+  EMPTY = new({ # :nodoc:
+    checksum: 0,
+    gname: "",
+    linkname: "",
+    magic: "",
+    mode: 0,
+    name: "",
+    prefix: "",
+    size: 0,
+    uname: "",
+    version: 0,
+
+    empty: true,
+  }).freeze
+  private_constant :EMPTY
+
   ##
   # Is the tar entry empty?
 
@@ -241,7 +257,7 @@ class Gem::Package::TarHeader
 
     header = header.pack PACK_FORMAT
 
-    header << ("\0" * ((512 - header.size) % 512))
+    header.ljust 512, "\0"
   end
 
   def oct(num, len)

data/lib/rubygems/package.rb

@@ -7,7 +7,6 @@
 
 # rubocop:enable Style/AsciiComments
 
-require_relative "../rubygems"
 require_relative "security"
 require_relative "user_interaction"
 
@@ -59,7 +58,7 @@ class Gem::Package
 
     def initialize(message, source = nil)
       if source
-        @path = source.path
+        @path = source.is_a?(String) ? source : source.path
 
         message += " in #{path}" if path
       end
@@ -295,7 +294,6 @@ class Gem::Package
 
     Gem.load_yaml
 
-    @spec.mark_version
     @spec.validate true, strict_validation unless skip_validation
 
     setup_signer(
@@ -454,7 +452,7 @@ EOM
 
         if entry.file?
           File.open(destination, "wb") {|out| copy_stream(entry, out) }
-          FileUtils.chmod file_mode(entry.header.mode), destination
+          FileUtils.chmod file_mode(entry.header.mode) & ~File.umask, destination
         end
 
         verbose destination
@@ -528,12 +526,13 @@ EOM
   # Loads a Gem::Specification from the TarEntry +entry+
 
   def load_spec(entry) # :nodoc:
+    limit = 10 * 1024 * 1024
     case entry.full_name
     when "metadata" then
-      @spec = Gem::Specification.from_yaml entry.read
+      @spec = Gem::Specification.from_yaml limit_read(entry, "metadata", limit)
     when "metadata.gz" then
       Zlib::GzipReader.wrap(entry, external_encoding: Encoding::UTF_8) do |gzio|
-        @spec = Gem::Specification.from_yaml gzio.read
+        @spec = Gem::Specification.from_yaml limit_read(gzio, "metadata.gz", limit)
       end
     end
   end
@@ -557,7 +556,7 @@ EOM
 
     @checksums = gem.seek "checksums.yaml.gz" do |entry|
       Zlib::GzipReader.wrap entry do |gz_io|
-        Gem::SafeYAML.safe_load gz_io.read
+        Gem::SafeYAML.safe_load limit_read(gz_io, "checksums.yaml.gz", 10 * 1024 * 1024)
       end
     end
   end
@@ -664,7 +663,7 @@ EOM
 
     case file_name
     when /\.sig$/ then
-      @signatures[$`] = entry.read if @security_policy
+      @signatures[$`] = limit_read(entry, file_name, 1024 * 1024) if @security_policy
       return
     else
       digest entry
@@ -724,6 +723,12 @@ EOM
       IO.copy_stream(src, dst)
     end
   end
+
+  def limit_read(io, name, limit)
+    bytes = io.read(limit + 1)
+    raise Gem::Package::FormatError, "#{name} is too big (over #{limit} bytes)" if bytes.size > limit
+    bytes
+  end
 end
 
 require_relative "package/digest_io"

data/lib/rubygems/platform.rb

@@ -134,6 +134,7 @@ class Gem::Platform
                       when /netbsdelf/ then             ["netbsdelf", nil]
                       when /openbsd(\d+\.\d+)?/ then    ["openbsd",   $1]
                       when /solaris(\d+\.\d+)?/ then    ["solaris",   $1]
+                      when /wasi/ then                  ["wasi",      nil]
                       # test
                       when /^(\w+_platform)(\d+)?/ then [$1,          $2]
                       else ["unknown", nil]
@@ -175,7 +176,7 @@ class Gem::Platform
   # they have the same version, or either one has no version
   #
   # Additionally, the platform will match if the local CPU is 'arm' and the
-  # other CPU starts with "arm" (for generic ARM family support).
+  # other CPU starts with "armv" (for generic 32-bit ARM family support).
   #
   # Of note, this method is not commutative. Indeed the OS 'linux' has a
   # special case: the version is the libc name, yet while "no version" stands
@@ -196,7 +197,7 @@ class Gem::Platform
 
     # cpu
     ([nil,"universal"].include?(@cpu) || [nil, "universal"].include?(other.cpu) || @cpu == other.cpu ||
-    (@cpu == "arm" && other.cpu.start_with?("arm"))) &&
+    (@cpu == "arm" && other.cpu.start_with?("armv"))) &&
 
       # os
       @os == other.os &&

data/lib/rubygems/remote_fetcher.rb

@@ -74,7 +74,7 @@ class Gem::RemoteFetcher
 
   def initialize(proxy=nil, dns=nil, headers={})
     require_relative "core_ext/tcpsocket_init" if Gem.configuration.ipv4_fallback_enabled
-    require_relative "net/http"
+    require_relative "vendored_net_http"
     require "stringio"
     require_relative "vendor/uri/lib/uri"
 

data/lib/rubygems/request.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require_relative "net/http"
+require_relative "vendored_net_http"
 require_relative "user_interaction"
 
 class Gem::Request

data/lib/rubygems/request_set.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require_relative "tsort"
+require_relative "vendored_tsort"
 
 ##
 # A RequestSet groups a request to activate a set of dependencies.

data/lib/rubygems/requirement.rb

@@ -13,8 +13,8 @@ class Gem::Requirement
   OPS = { # :nodoc:
     "=" => lambda {|v, r| v == r },
     "!=" => lambda {|v, r| v != r },
-    ">" => lambda {|v, r| v >  r },
-    "<" => lambda {|v, r| v <  r },
+    ">" => lambda {|v, r| v > r },
+    "<" => lambda {|v, r| v < r },
     ">=" => lambda {|v, r| v >= r },
     "<=" => lambda {|v, r| v <= r },
     "~>" => lambda {|v, r| v >= r && v.release < r.bump },

data/lib/rubygems/resolver/spec_specification.rb

@@ -66,4 +66,11 @@ class Gem::Resolver::SpecSpecification < Gem::Resolver::Specification
   def version
     spec.version
   end
+
+  ##
+  # The hash value for this specification.
+
+  def hash
+    spec.hash
+  end
 end

data/lib/rubygems/s3_uri_signer.rb

@@ -140,7 +140,7 @@ class Gem::S3URISigner
   end
 
   def ec2_metadata_credentials_json
-    require_relative "net/http"
+    require_relative "vendored_net_http"
     require_relative "request"
     require_relative "request/connection_pools"
     require "json"

data/lib/rubygems/safe_yaml.rb

@@ -25,8 +25,17 @@ module Gem
       runtime
     ].freeze
 
+    @aliases_enabled = true
+    def self.aliases_enabled=(value) # :nodoc:
+      @aliases_enabled = !!value
+    end
+
+    def self.aliases_enabled? # :nodoc:
+      @aliases_enabled
+    end
+
     def self.safe_load(input)
-      ::Psych.safe_load(input, permitted_classes: PERMITTED_CLASSES, permitted_symbols: PERMITTED_SYMBOLS, aliases: true)
+      ::Psych.safe_load(input, permitted_classes: PERMITTED_CLASSES, permitted_symbols: PERMITTED_SYMBOLS, aliases: @aliases_enabled)
     end
 
     def self.load(input)

data/lib/rubygems/security.rb

@@ -323,7 +323,7 @@ require_relative "openssl"
 # == Original author
 #
 # Paul Duncan <pabs@pablotron.org>
-# http://pablotron.org/
+# https://pablotron.org/
 
 module Gem::Security
   ##