rubygems-update 3.5.9 → 3.5.11

data/lib/rubygems/commands/setup_command.rb

@@ -585,6 +585,8 @@ abort "#{deprecation_message}"
 
     args = %w[--all --only-executables --silent]
     args << "--bindir=#{bindir}"
+    args << "--install-dir=#{default_dir}"
+
     if options[:env_shebang]
       args << "--env-shebang"
     end

data/lib/rubygems/commands/uninstall_command.rb

@@ -184,7 +184,7 @@ that is a dependency of an existing gem.  You can use the
   rescue Gem::GemNotInHomeException => e
     spec = e.spec
     alert("In order to remove #{spec.name}, please execute:\n" \
-          "\tgem uninstall #{spec.name} --install-dir=#{spec.installation_path}")
+          "\tgem uninstall #{spec.name} --install-dir=#{spec.base_dir}")
   rescue Gem::UninstallError => e
     spec = e.spec
     alert_error("Error: unable to successfully uninstall '#{spec.name}' which is " \

data/lib/rubygems/commands/update_command.rb

@@ -197,18 +197,17 @@ command to remove old versions.
       yield
     else
       require "tmpdir"
-      tmpdir = Dir.mktmpdir
-      FileUtils.mv Gem.plugindir, tmpdir
+      Dir.mktmpdir("gem_update") do |tmpdir|
+        FileUtils.mv Gem.plugindir, tmpdir
 
-      status = yield
+        status = yield
 
-      if status
-        FileUtils.rm_rf tmpdir
-      else
-        FileUtils.mv File.join(tmpdir, "plugins"), Gem.plugindir
-      end
+        unless status
+          FileUtils.mv File.join(tmpdir, "plugins"), Gem.plugindir
+        end
 
-      status
+        status
+      end
     end
   end
 

data/lib/rubygems/dependency.rb

@@ -271,15 +271,7 @@ class Gem::Dependency
   end
 
   def matching_specs(platform_only = false)
-    env_req = Gem.env_requirement(name)
-    matches = Gem::Specification.stubs_for(name).find_all do |spec|
-      requirement.satisfied_by?(spec.version) && env_req.satisfied_by?(spec.version)
-    end.map(&:to_spec)
-
-    if prioritizes_bundler?
-      require_relative "bundler_version_finder"
-      Gem::BundlerVersionFinder.prioritize!(matches)
-    end
+    matches = Gem::Specification.find_all_by_name(name, requirement)
 
     if platform_only
       matches.reject! do |spec|
@@ -297,10 +289,6 @@ class Gem::Dependency
     @requirement.specific?
   end
 
-  def prioritizes_bundler?
-    name == "bundler" && !specific?
-  end
-
   def to_specs
     matches = matching_specs true
 

data/lib/rubygems/deprecate.rb

@@ -69,99 +69,101 @@
 #       end
 #     end
 
-module Gem::Deprecate
-  def self.skip # :nodoc:
-    @skip ||= false
-  end
+module Gem
+  module Deprecate
+    def self.skip # :nodoc:
+      @skip ||= false
+    end
 
-  def self.skip=(v) # :nodoc:
-    @skip = v
-  end
+    def self.skip=(v) # :nodoc:
+      @skip = v
+    end
 
-  ##
-  # Temporarily turn off warnings. Intended for tests only.
+    ##
+    # Temporarily turn off warnings. Intended for tests only.
 
-  def skip_during
-    original = Gem::Deprecate.skip
-    Gem::Deprecate.skip = true
-    yield
-  ensure
-    Gem::Deprecate.skip = original
-  end
+    def skip_during
+      original = Gem::Deprecate.skip
+      Gem::Deprecate.skip = true
+      yield
+    ensure
+      Gem::Deprecate.skip = original
+    end
 
-  def self.next_rubygems_major_version # :nodoc:
-    Gem::Version.new(Gem.rubygems_version.segments.first).bump
-  end
+    def self.next_rubygems_major_version # :nodoc:
+      Gem::Version.new(Gem.rubygems_version.segments.first).bump
+    end
 
-  ##
-  # Simple deprecation method that deprecates +name+ by wrapping it up
-  # in a dummy method. It warns on each call to the dummy method
-  # telling the user of +repl+ (unless +repl+ is :none) and the
-  # year/month that it is planned to go away.
+    ##
+    # Simple deprecation method that deprecates +name+ by wrapping it up
+    # in a dummy method. It warns on each call to the dummy method
+    # telling the user of +repl+ (unless +repl+ is :none) and the
+    # year/month that it is planned to go away.
 
-  def deprecate(name, repl, year, month)
-    class_eval do
-      old = "_deprecated_#{name}"
-      alias_method old, name
-      define_method name do |*args, &block|
-        klass = is_a? Module
-        target = klass ? "#{self}." : "#{self.class}#"
-        msg = [
-          "NOTE: #{target}#{name} is deprecated",
-          repl == :none ? " with no replacement" : "; use #{repl} instead",
-          format(". It will be removed on or after %4d-%02d.", year, month),
-          "\n#{target}#{name} called from #{Gem.location_of_caller.join(":")}",
-        ]
-        warn "#{msg.join}." unless Gem::Deprecate.skip
-        send old, *args, &block
+    def deprecate(name, repl, year, month)
+      class_eval do
+        old = "_deprecated_#{name}"
+        alias_method old, name
+        define_method name do |*args, &block|
+          klass = is_a? Module
+          target = klass ? "#{self}." : "#{self.class}#"
+          msg = [
+            "NOTE: #{target}#{name} is deprecated",
+            repl == :none ? " with no replacement" : "; use #{repl} instead",
+            format(". It will be removed on or after %4d-%02d.", year, month),
+            "\n#{target}#{name} called from #{Gem.location_of_caller.join(":")}",
+          ]
+          warn "#{msg.join}." unless Gem::Deprecate.skip
+          send old, *args, &block
+        end
+        ruby2_keywords name if respond_to?(:ruby2_keywords, true)
       end
-      ruby2_keywords name if respond_to?(:ruby2_keywords, true)
     end
-  end
 
-  ##
-  # Simple deprecation method that deprecates +name+ by wrapping it up
-  # in a dummy method. It warns on each call to the dummy method
-  # telling the user of +repl+ (unless +repl+ is :none) and the
-  # Rubygems version that it is planned to go away.
+    ##
+    # Simple deprecation method that deprecates +name+ by wrapping it up
+    # in a dummy method. It warns on each call to the dummy method
+    # telling the user of +repl+ (unless +repl+ is :none) and the
+    # Rubygems version that it is planned to go away.
 
-  def rubygems_deprecate(name, replacement=:none)
-    class_eval do
-      old = "_deprecated_#{name}"
-      alias_method old, name
-      define_method name do |*args, &block|
-        klass = is_a? Module
-        target = klass ? "#{self}." : "#{self.class}#"
-        msg = [
-          "NOTE: #{target}#{name} is deprecated",
-          replacement == :none ? " with no replacement" : "; use #{replacement} instead",
-          ". It will be removed in Rubygems #{Gem::Deprecate.next_rubygems_major_version}",
-          "\n#{target}#{name} called from #{Gem.location_of_caller.join(":")}",
-        ]
-        warn "#{msg.join}." unless Gem::Deprecate.skip
-        send old, *args, &block
+    def rubygems_deprecate(name, replacement=:none)
+      class_eval do
+        old = "_deprecated_#{name}"
+        alias_method old, name
+        define_method name do |*args, &block|
+          klass = is_a? Module
+          target = klass ? "#{self}." : "#{self.class}#"
+          msg = [
+            "NOTE: #{target}#{name} is deprecated",
+            replacement == :none ? " with no replacement" : "; use #{replacement} instead",
+            ". It will be removed in Rubygems #{Gem::Deprecate.next_rubygems_major_version}",
+            "\n#{target}#{name} called from #{Gem.location_of_caller.join(":")}",
+          ]
+          warn "#{msg.join}." unless Gem::Deprecate.skip
+          send old, *args, &block
+        end
+        ruby2_keywords name if respond_to?(:ruby2_keywords, true)
       end
-      ruby2_keywords name if respond_to?(:ruby2_keywords, true)
     end
-  end
 
-  # Deprecation method to deprecate Rubygems commands
-  def rubygems_deprecate_command(version = Gem::Deprecate.next_rubygems_major_version)
-    class_eval do
-      define_method "deprecated?" do
-        true
-      end
+    # Deprecation method to deprecate Rubygems commands
+    def rubygems_deprecate_command(version = Gem::Deprecate.next_rubygems_major_version)
+      class_eval do
+        define_method "deprecated?" do
+          true
+        end
 
-      define_method "deprecation_warning" do
-        msg = [
-          "#{command} command is deprecated",
-          ". It will be removed in Rubygems #{version}.\n",
-        ]
+        define_method "deprecation_warning" do
+          msg = [
+            "#{command} command is deprecated",
+            ". It will be removed in Rubygems #{version}.\n",
+          ]
 
-        alert_warning msg.join.to_s unless Gem::Deprecate.skip
+          alert_warning msg.join.to_s unless Gem::Deprecate.skip
+        end
       end
     end
-  end
 
-  module_function :rubygems_deprecate, :rubygems_deprecate_command, :skip_during
+    module_function :rubygems_deprecate, :rubygems_deprecate_command, :skip_during
+  end
 end

data/lib/rubygems/ext/cargo_builder.rb

@@ -185,6 +185,7 @@ class Gem::Ext::CargoBuilder < Gem::Ext::Builder
   end
 
   def cargo_dylib_path(dest_path, crate_name)
+    so_ext = RbConfig::CONFIG["SOEXT"]
     prefix = so_ext == "dll" ? "" : "lib"
     path_parts = [dest_path]
     path_parts << ENV["CARGO_BUILD_TARGET"] if ENV["CARGO_BUILD_TARGET"]
@@ -313,22 +314,6 @@ EOF
     deffile_path
   end
 
-  # We have to basically reimplement <code>RbConfig::CONFIG['SOEXT']</code> here to support
-  # Ruby < 2.5
-  #
-  # @see https://github.com/ruby/ruby/blob/c87c027f18c005460746a74c07cd80ee355b16e4/configure.ac#L3185
-  def so_ext
-    return RbConfig::CONFIG["SOEXT"] if RbConfig::CONFIG.key?("SOEXT")
-
-    if win_target?
-      "dll"
-    elsif darwin_target?
-      "dylib"
-    else
-      "so"
-    end
-  end
-
   # Corresponds to $(LIBPATH) in mkmf
   def mkmf_libpath
     ["-L", "native=#{makefile_config("libdir")}"]

data/lib/rubygems/gemcutter_utilities/webauthn_poller.rb

@@ -69,8 +69,10 @@ module Gem::GemcutterUtilities
       rubygems_api_request(:get, "api/v1/webauthn_verification/#{webauthn_token}/status.json") do |request|
         if credentials.empty?
           request.add_field "Authorization", api_key
+        elsif credentials[:identifier] && credentials[:password]
+          request.basic_auth credentials[:identifier], credentials[:password]
         else
-          request.basic_auth credentials[:email], credentials[:password]
+          raise Gem::WebauthnVerificationError, "Provided missing credentials"
         end
       end
     end

data/lib/rubygems/installer.rb

@@ -344,7 +344,7 @@ class Gem::Installer
 
     say spec.post_install_message if options[:post_install_message] && !spec.post_install_message.nil?
 
-    Gem::Specification.add_spec(spec)
+    Gem::Specification.add_spec(spec) unless @install_dir
 
     load_plugin
 

data/lib/rubygems/package/tar_header.rb

@@ -95,14 +95,14 @@ class Gem::Package::TarHeader
 
   attr_reader(*FIELDS)
 
-  EMPTY_HEADER = ("\0" * 512).freeze # :nodoc:
+  EMPTY_HEADER = ("\0" * 512).b.freeze # :nodoc:
 
   ##
   # Creates a tar header from IO +stream+
 
   def self.from(stream)
     header = stream.read 512
-    empty = (header == EMPTY_HEADER)
+    return EMPTY if header == EMPTY_HEADER
 
     fields = header.unpack UNPACK_FORMAT
 
@@ -123,7 +123,7 @@ class Gem::Package::TarHeader
         devminor: strict_oct(fields.shift),
         prefix: fields.shift,
 
-        empty: empty
+        empty: false
   end
 
   def self.strict_oct(str)
@@ -172,6 +172,22 @@ class Gem::Package::TarHeader
     @empty = vals[:empty]
   end
 
+  EMPTY = new({ # :nodoc:
+    checksum: 0,
+    gname: "",
+    linkname: "",
+    magic: "",
+    mode: 0,
+    name: "",
+    prefix: "",
+    size: 0,
+    uname: "",
+    version: 0,
+
+    empty: true,
+  }).freeze
+  private_constant :EMPTY
+
   ##
   # Is the tar entry empty?
 
@@ -241,7 +257,7 @@ class Gem::Package::TarHeader
 
     header = header.pack PACK_FORMAT
 
-    header << ("\0" * ((512 - header.size) % 512))
+    header.ljust 512, "\0"
   end
 
   def oct(num, len)

data/lib/rubygems/package.rb

@@ -7,7 +7,6 @@
 
 # rubocop:enable Style/AsciiComments
 
-require_relative "../rubygems"
 require_relative "security"
 require_relative "user_interaction"
 
@@ -295,7 +294,6 @@ class Gem::Package
 
     Gem.load_yaml
 
-    @spec.mark_version
     @spec.validate true, strict_validation unless skip_validation
 
     setup_signer(
@@ -528,12 +526,13 @@ EOM
   # Loads a Gem::Specification from the TarEntry +entry+
 
   def load_spec(entry) # :nodoc:
+    limit = 10 * 1024 * 1024
     case entry.full_name
     when "metadata" then
-      @spec = Gem::Specification.from_yaml entry.read
+      @spec = Gem::Specification.from_yaml limit_read(entry, "metadata", limit)
     when "metadata.gz" then
       Zlib::GzipReader.wrap(entry, external_encoding: Encoding::UTF_8) do |gzio|
-        @spec = Gem::Specification.from_yaml gzio.read
+        @spec = Gem::Specification.from_yaml limit_read(gzio, "metadata.gz", limit)
       end
     end
   end
@@ -557,7 +556,7 @@ EOM
 
     @checksums = gem.seek "checksums.yaml.gz" do |entry|
       Zlib::GzipReader.wrap entry do |gz_io|
-        Gem::SafeYAML.safe_load gz_io.read
+        Gem::SafeYAML.safe_load limit_read(gz_io, "checksums.yaml.gz", 10 * 1024 * 1024)
       end
     end
   end
@@ -664,7 +663,7 @@ EOM
 
     case file_name
     when /\.sig$/ then
-      @signatures[$`] = entry.read if @security_policy
+      @signatures[$`] = limit_read(entry, file_name, 1024 * 1024) if @security_policy
       return
     else
       digest entry
@@ -724,6 +723,12 @@ EOM
       IO.copy_stream(src, dst)
     end
   end
+
+  def limit_read(io, name, limit)
+    bytes = io.read(limit + 1)
+    raise Gem::Package::FormatError, "#{name} is too big (over #{limit} bytes)" if bytes.size > limit
+    bytes
+  end
 end
 
 require_relative "package/digest_io"

data/lib/rubygems/platform.rb

@@ -134,6 +134,7 @@ class Gem::Platform
                       when /netbsdelf/ then             ["netbsdelf", nil]
                       when /openbsd(\d+\.\d+)?/ then    ["openbsd",   $1]
                       when /solaris(\d+\.\d+)?/ then    ["solaris",   $1]
+                      when /wasi/ then                  ["wasi",      nil]
                       # test
                       when /^(\w+_platform)(\d+)?/ then [$1,          $2]
                       else ["unknown", nil]