rubygems-update 3.7.1 → 4.0.0.beta1

data/lib/rubygems/s3_uri_signer.rb

@@ -1,11 +1,14 @@
 # frozen_string_literal: true
 
 require_relative "openssl"
+require_relative "user_interaction"
 
 ##
 # S3URISigner implements AWS SigV4 for S3 Source to avoid a dependency on the aws-sdk-* gems
 # More on AWS SigV4: https://docs.aws.amazon.com/AmazonS3/latest/API/sig-v4-authenticating-requests.html
 class Gem::S3URISigner
+  include Gem::UserInteraction
+
   class ConfigurationError < Gem::Exception
     def initialize(message)
       super message
@@ -147,17 +150,40 @@ class Gem::S3URISigner
     require_relative "request/connection_pools"
     require "json"
 
-    iam_info = ec2_metadata_request(EC2_IAM_INFO)
+    # First try V2 fallback to V1
+    res = nil
+    begin
+      res = ec2_metadata_credentials_imds_v2
+    rescue InstanceProfileError
+      alert_warning "Unable to access ec2 credentials via IMDSv2, falling back to IMDSv1"
+      res = ec2_metadata_credentials_imds_v1
+    end
+    res
+  end
+
+  def ec2_metadata_credentials_imds_v2
+    token = ec2_metadata_token
+    iam_info = ec2_metadata_request(EC2_IAM_INFO, token:)
     # Expected format: arn:aws:iam::<id>:instance-profile/<role_name>
     role_name = iam_info["InstanceProfileArn"].split("/").last
-    ec2_metadata_request(EC2_IAM_SECURITY_CREDENTIALS + role_name)
+    ec2_metadata_request(EC2_IAM_SECURITY_CREDENTIALS + role_name, token:)
   end
 
-  def ec2_metadata_request(url)
-    uri = Gem::URI(url)
-    @request_pool ||= create_request_pool(uri)
-    request = Gem::Request.new(uri, Gem::Net::HTTP::Get, nil, @request_pool)
-    response = request.fetch
+  def ec2_metadata_credentials_imds_v1
+    iam_info = ec2_metadata_request(EC2_IAM_INFO, token: nil)
+    # Expected format: arn:aws:iam::<id>:instance-profile/<role_name>
+    role_name = iam_info["InstanceProfileArn"].split("/").last
+    ec2_metadata_request(EC2_IAM_SECURITY_CREDENTIALS + role_name, token: nil)
+  end
+
+  def ec2_metadata_request(url, token:)
+    request = ec2_iam_request(Gem::URI(url), Gem::Net::HTTP::Get)
+
+    response = request.fetch do |req|
+      if token
+        req.add_field "X-aws-ec2-metadata-token", token
+      end
+    end
 
     case response
     when Gem::Net::HTTPOK then
@@ -167,6 +193,26 @@ class Gem::S3URISigner
     end
   end
 
+  def ec2_metadata_token
+    request = ec2_iam_request(Gem::URI(EC2_IAM_TOKEN), Gem::Net::HTTP::Put)
+
+    response = request.fetch do |req|
+      req.add_field "X-aws-ec2-metadata-token-ttl-seconds", 60
+    end
+
+    case response
+    when Gem::Net::HTTPOK then
+      response.body
+    else
+      raise InstanceProfileError.new("Unable to fetch AWS metadata from #{uri}: #{response.message} #{response.code}")
+    end
+  end
+
+  def ec2_iam_request(uri, verb)
+    @request_pool ||= create_request_pool(uri)
+    Gem::Request.new(uri, verb, nil, @request_pool)
+  end
+
   def create_request_pool(uri)
     proxy_uri = Gem::Request.proxy_uri(Gem::Request.get_proxy_from_env(uri.scheme))
     certs = Gem::Request.get_cert_files
@@ -174,6 +220,7 @@ class Gem::S3URISigner
   end
 
   BASE64_URI_TRANSLATE = { "+" => "%2B", "/" => "%2F", "=" => "%3D", "\n" => "" }.freeze
+  EC2_IAM_TOKEN = "http://169.254.169.254/latest/api/token"
   EC2_IAM_INFO = "http://169.254.169.254/latest/meta-data/iam/info"
   EC2_IAM_SECURITY_CREDENTIALS = "http://169.254.169.254/latest/meta-data/iam/security-credentials/"
 end

data/lib/rubygems/security/signer.rb

@@ -52,7 +52,7 @@ class Gem::Security::Signer
     re_signed_cert = Gem::Security.re_sign(
       expired_cert,
       private_key,
-      (Gem::Security::ONE_DAY * Gem.configuration.cert_expiration_length_days)
+      Gem::Security::ONE_DAY * Gem.configuration.cert_expiration_length_days
     )
 
     Gem::Security.write(re_signed_cert, expired_cert_path)

data/lib/rubygems/source.rb

@@ -190,7 +190,7 @@ class Gem::Source
   # Downloads +spec+ and writes it to +dir+.  See also
   # Gem::RemoteFetcher#download.
 
-  def download(spec, dir=Dir.pwd)
+  def download(spec, dir = Dir.pwd)
     fetcher = Gem::RemoteFetcher.fetcher
     fetcher.download spec, uri.to_s, dir
   end
@@ -210,7 +210,7 @@ class Gem::Source
     end
   end
 
-  def typo_squatting?(host, distance_threshold=4)
+  def typo_squatting?(host, distance_threshold = 4)
     return if @uri.host.nil?
     levenshtein_distance(@uri.host, host).between? 1, distance_threshold
   end

data/lib/rubygems/source_list.rb

@@ -59,6 +59,42 @@ class Gem::SourceList
     src
   end
 
+  ##
+  # Prepends +obj+ to the beginning of the source list which may be a Gem::Source, Gem::URI or URI
+  # Moves +obj+ to the beginning of the list if already present.
+  # String.
+
+  def prepend(obj)
+    src = case obj
+          when Gem::Source
+            obj
+          else
+            Gem::Source.new(obj)
+    end
+
+    @sources.delete(src) if @sources.include?(src)
+    @sources.unshift(src)
+    src
+  end
+
+  ##
+  # Appends +obj+ to the end of the source list, moving it if already present.
+  # +obj+ may be a Gem::Source, Gem::URI or URI String.
+  # Moves +obj+ to the end of the list if already present.
+
+  def append(obj)
+    src = case obj
+          when Gem::Source
+            obj
+          else
+            Gem::Source.new(obj)
+    end
+
+    @sources.delete(src) if @sources.include?(src)
+    @sources << src
+    src
+  end
+
   ##
   # Replaces this SourceList with the sources in +other+  See #<< for
   # acceptable items in +other+.

data/lib/rubygems/spec_fetcher.rb

@@ -83,7 +83,7 @@ class Gem::SpecFetcher
   #
   # If +matching_platform+ is false, gems for all platforms are returned.
 
-  def search_for_dependency(dependency, matching_platform=true)
+  def search_for_dependency(dependency, matching_platform = true)
     found = {}
 
     rejected_specs = {}
@@ -130,7 +130,7 @@ class Gem::SpecFetcher
   ##
   # Return all gem name tuples who's names match +obj+
 
-  def detect(type=:complete)
+  def detect(type = :complete)
     tuples = []
 
     list, _ = available_specs(type)
@@ -150,7 +150,7 @@ class Gem::SpecFetcher
   #
   # If +matching_platform+ is false, gems for all platforms are returned.
 
-  def spec_for_dependency(dependency, matching_platform=true)
+  def spec_for_dependency(dependency, matching_platform = true)
     tuples, errors = search_for_dependency(dependency, matching_platform)
 
     specs = []
@@ -280,7 +280,7 @@ class Gem::SpecFetcher
   # Retrieves NameTuples from +source+ of the given +type+ (:prerelease,
   # etc.).  If +gracefully_ignore+ is true, errors are ignored.
 
-  def tuples_for(source, type, gracefully_ignore=false) # :nodoc:
+  def tuples_for(source, type, gracefully_ignore = false) # :nodoc:
     @caches[type][source.uri] ||=
       source.load_specs(type).sort_by(&:name)
   rescue Gem::RemoteFetcher::FetchError

data/lib/rubygems/specification.rb

@@ -7,7 +7,6 @@
 # See LICENSE.txt for permissions.
 #++
 
-require_relative "deprecate"
 require_relative "basic_specification"
 require_relative "stub_specification"
 require_relative "platform"
@@ -38,8 +37,6 @@ require "rbconfig"
 # items you may add to a specification.
 
 class Gem::Specification < Gem::BasicSpecification
-  extend Gem::Deprecate
-
   # REFACTOR: Consider breaking out this version stuff into a separate
   # module. There's enough special stuff around it that it may justify
   # a separate class.
@@ -488,8 +485,6 @@ class Gem::Specification < Gem::BasicSpecification
     end
 
     @platform = @new_platform.to_s
-
-    invalidate_memoized_attributes
   end
 
   ##
@@ -737,14 +732,6 @@ class Gem::Specification < Gem::BasicSpecification
 
   attr_accessor :autorequire # :nodoc:
 
-  ##
-  # Sets the default executable for this gem.
-  #
-  # Deprecated: You must now specify the executable name to  Gem.bin_path.
-
-  attr_writer :default_executable
-  rubygems_deprecate :default_executable=
-
   ##
   # Allows deinstallation of gems with legacy platforms.
 
@@ -1321,7 +1308,7 @@ class Gem::Specification < Gem::BasicSpecification
     spec.instance_variable_set :@authors,                   array[12]
     spec.instance_variable_set :@description,               array[13]
     spec.instance_variable_set :@homepage,                  array[14]
-    spec.instance_variable_set :@has_rdoc,                  array[15]
+    # offset due to has_rdoc removal
     spec.instance_variable_set :@licenses,                  array[17]
     spec.instance_variable_set :@metadata,                  array[18]
     spec.instance_variable_set :@loaded,                    false
@@ -1620,14 +1607,14 @@ class Gem::Specification < Gem::BasicSpecification
   # spec's cached gem.
 
   def cache_dir
-    @cache_dir ||= File.join base_dir, "cache"
+    File.join base_dir, "cache"
   end
 
   ##
   # Returns the full path to the cached gem for this spec.
 
   def cache_file
-    @cache_file ||= File.join cache_dir, "#{full_name}.gem"
+    File.join cache_dir, "#{full_name}.gem"
   end
 
   ##
@@ -1716,24 +1703,6 @@ class Gem::Specification < Gem::BasicSpecification
     end
   end
 
-  ##
-  # The default executable for this gem.
-  #
-  # Deprecated: The name of the gem is assumed to be the name of the
-  # executable now.  See Gem.bin_path.
-
-  def default_executable # :nodoc:
-    if defined?(@default_executable) && @default_executable
-      result = @default_executable
-    elsif @executables && @executables.size == 1
-      result = Array(@executables).first
-    else
-      result = nil
-    end
-    result
-  end
-  rubygems_deprecate :default_executable
-
   ##
   # The default value for specification attribute +name+
 
@@ -1757,7 +1726,7 @@ class Gem::Specification < Gem::BasicSpecification
   #
   #   [depending_gem, dependency, [list_of_gems_that_satisfy_dependency]]
 
-  def dependent_gems(check_dev=true)
+  def dependent_gems(check_dev = true)
     out = []
     Gem::Specification.each do |spec|
       deps = check_dev ? spec.dependencies : spec.runtime_dependencies
@@ -1903,10 +1872,6 @@ class Gem::Specification < Gem::BasicSpecification
     spec
   end
 
-  def full_name
-    @full_name ||= super
-  end
-
   ##
   # Work around old bundler versions removing my methods
   # Can be removed once RubyGems can no longer install Bundler 2.5
@@ -1919,29 +1884,6 @@ class Gem::Specification < Gem::BasicSpecification
     @gems_dir ||= File.join(base_dir, "gems")
   end
 
-  ##
-  # Deprecated and ignored, defaults to true.
-  #
-  # Formerly used to indicate this gem was RDoc-capable.
-
-  def has_rdoc # :nodoc:
-    true
-  end
-  rubygems_deprecate :has_rdoc
-
-  ##
-  # Deprecated and ignored.
-  #
-  # Formerly used to indicate this gem was RDoc-capable.
-
-  def has_rdoc=(ignored) # :nodoc:
-    @has_rdoc = true
-  end
-  rubygems_deprecate :has_rdoc=
-
-  alias_method :has_rdoc?, :has_rdoc # :nodoc:
-  rubygems_deprecate :has_rdoc?
-
   ##
   # True if this gem has files in test_files
 
@@ -2044,17 +1986,6 @@ class Gem::Specification < Gem::BasicSpecification
     end
   end
 
-  ##
-  # Expire memoized instance variables that can incorrectly generate, replace
-  # or miss files due changes in certain attributes used to compute them.
-
-  def invalidate_memoized_attributes
-    @full_name = nil
-    @cache_file = nil
-  end
-
-  private :invalidate_memoized_attributes
-
   def inspect # :nodoc:
     if $DEBUG
       super
@@ -2093,8 +2024,6 @@ class Gem::Specification < Gem::BasicSpecification
   def internal_init # :nodoc:
     super
     @bin_dir       = nil
-    @cache_dir     = nil
-    @cache_file    = nil
     @doc_dir       = nil
     @ri_dir        = nil
     @spec_dir      = nil
@@ -2447,8 +2376,6 @@ class Gem::Specification < Gem::BasicSpecification
       :required_rubygems_version,
       :specification_version,
       :version,
-      :has_rdoc,
-      :default_executable,
       :metadata,
       :signing_key,
     ]
@@ -2586,29 +2513,11 @@ class Gem::Specification < Gem::BasicSpecification
     Gem::SpecificationPolicy.new(self).validate_for_resolution
   end
 
-  def validate_metadata
-    Gem::SpecificationPolicy.new(self).validate_metadata
-  end
-  rubygems_deprecate :validate_metadata
-
-  def validate_dependencies
-    Gem::SpecificationPolicy.new(self).validate_dependencies
-  end
-  rubygems_deprecate :validate_dependencies
-
-  def validate_permissions
-    Gem::SpecificationPolicy.new(self).validate_permissions
-  end
-  rubygems_deprecate :validate_permissions
-
   ##
   # Set the version to +version+.
 
   def version=(version)
-    @version = Gem::Version.create(version)
-    return if @version.nil?
-
-    invalidate_memoized_attributes
+    @version = version.nil? ? version : Gem::Version.create(version)
   end
 
   def stubbed?

data/lib/rubygems/specification_policy.rb

@@ -190,9 +190,6 @@ duplicate dependency on #{dep}, (#{prev.requirement}) use:
 
   ##
   # Checks that the gem does not depend on itself.
-  # Checks that dependencies use requirements as we recommend.  Warnings are
-  # issued when dependencies are open-ended or overly strict for semantic
-  # versioning.
 
   def validate_dependencies # :nodoc:
     warning_messages = []
@@ -200,39 +197,6 @@ duplicate dependency on #{dep}, (#{prev.requirement}) use:
       if dep.name == @specification.name # warn on self reference
         warning_messages << "Self referencing dependency is unnecessary and strongly discouraged."
       end
-
-      prerelease_dep = dep.requirements_list.any? do |req|
-        Gem::Requirement.new(req).prerelease?
-      end
-
-      warning_messages << "prerelease dependency on #{dep} is not recommended" if
-          prerelease_dep && !@specification.version.prerelease?
-
-      open_ended = dep.requirement.requirements.all? do |op, version|
-        !version.prerelease? && [">", ">="].include?(op)
-      end
-
-      next unless open_ended
-      op, dep_version = dep.requirement.requirements.first
-
-      segments = dep_version.segments
-
-      base = segments.first 2
-
-      recommendation = if [">", ">="].include?(op) && segments == [0]
-        "  use a bounded requirement, such as \"~> x.y\""
-      else
-        bugfix = if op == ">"
-          ", \"> #{dep_version}\""
-        elsif op == ">=" && base != segments
-          ", \">= #{dep_version}\""
-        end
-
-        "  if #{dep.name} is semantically versioned, use:\n" \
-        "    add_#{dep.type}_dependency \"#{dep.name}\", \"~> #{base.join "."}\"#{bugfix}"
-      end
-
-      warning_messages << ["open-ended dependency on #{dep} is not recommended", recommendation].join("\n") + "\n"
     end
     if warning_messages.any?
       warning_messages.each {|warning_message| warning warning_message }

data/lib/rubygems/specification_record.rb

@@ -73,7 +73,7 @@ module Gem
     end
 
     ##
-    # Adds +spec+ to the the record, keeping the collection properly sorted.
+    # Adds +spec+ to the record, keeping the collection properly sorted.
 
     def add_spec(spec)
       return if all.include? spec

data/lib/rubygems/text.rb

@@ -21,7 +21,7 @@ module Gem::Text
   # Wraps +text+ to +wrap+ characters and optionally indents by +indent+
   # characters
 
-  def format_text(text, wrap, indent=0)
+  def format_text(text, wrap, indent = 0)
     result = []
     work = clean_text(text)
 

data/lib/rubygems/uninstaller.rb

@@ -42,10 +42,25 @@ class Gem::Uninstaller
   attr_reader :spec
 
   ##
-  # Constructs an uninstaller that will uninstall +gem+
+  # Constructs an uninstaller that will uninstall gem named +gem+.
+  # +options+ is a Hash with the following keys:
+  #
+  # :version:: Version requirement for the gem to uninstall. If not specified,
+  #            uses Gem::Requirement.default.
+  # :install_dir:: The directory where the gem is installed. If not specified,
+  #                uses Gem.dir.
+  # :executables:: Whether executables should be removed without confirmation or not. If nil, asks the user explicitly.
+  # :all:: If more than one version matches the requirement, whether to forcefully remove all matching versions or ask the user to select specific matching versions that should be removed.
+  # :ignore:: Ignore broken dependency checks when uninstalling.
+  # :bin_dir:: Directory containing executables to remove. If not specified,
+  #            uses Gem.bindir.
+  # :format_executable:: In order to find executables to be removed, format executable names using Gem::Installer.exec_format.
+  # :abort_on_dependent:: Directly abort uninstallation if dependencies would be broken, rather than asking the user for confirmation.
+  # :check_dev:: When checking if uninstalling gem would leave broken dependencies around, also consider development dependencies.
+  # :force:: Set both :all and :ignore to true for forced uninstallation.
+  # :user_install:: Uninstall from user gem directory instead of system directory.
 
   def initialize(gem, options = {})
-    # TODO: document the valid options
     @gem                = gem
     @version            = options[:version] || Gem::Requirement.default
     @install_dir        = options[:install_dir]
@@ -57,10 +72,6 @@ class Gem::Uninstaller
     @bin_dir            = options[:bin_dir]
     @format_executable  = options[:format_executable]
     @abort_on_dependent = options[:abort_on_dependent]
-
-    # Indicate if development dependencies should be checked when
-    # uninstalling. (default: false)
-    #
     @check_dev = options[:check_dev]
 
     if options[:force]

data/lib/rubygems/user_interaction.rb

@@ -6,7 +6,6 @@
 # See LICENSE.txt for permissions.
 #++
 
-require_relative "deprecate"
 require_relative "text"
 
 ##
@@ -170,8 +169,6 @@ end
 # Gem::StreamUI implements a simple stream based user interface.
 
 class Gem::StreamUI
-  extend Gem::Deprecate
-
   ##
   # The input stream
 
@@ -193,7 +190,7 @@ class Gem::StreamUI
   # then special operations (like asking for passwords) will use the TTY
   # commands to disable character echo.
 
-  def initialize(in_stream, out_stream, err_stream=$stderr, usetty=true)
+  def initialize(in_stream, out_stream, err_stream = $stderr, usetty = true)
     @ins = in_stream
     @outs = out_stream
     @errs = err_stream
@@ -246,7 +243,7 @@ class Gem::StreamUI
   # to a tty, raises an exception if default is nil, otherwise returns
   # default.
 
-  def ask_yes_no(question, default=nil)
+  def ask_yes_no(question, default = nil)
     unless tty?
       if default.nil?
         raise Gem::OperationNotSupportedError,
@@ -325,14 +322,14 @@ class Gem::StreamUI
   ##
   # Display a statement.
 
-  def say(statement="")
+  def say(statement = "")
     @outs.puts statement
   end
 
   ##
   # Display an informational alert.  Will ask +question+ if it is not nil.
 
-  def alert(statement, question=nil)
+  def alert(statement, question = nil)
     @outs.puts "INFO:  #{statement}"
     ask(question) if question
   end
@@ -340,7 +337,7 @@ class Gem::StreamUI
   ##
   # Display a warning on stderr.  Will ask +question+ if it is not nil.
 
-  def alert_warning(statement, question=nil)
+  def alert_warning(statement, question = nil)
     @errs.puts "WARNING:  #{statement}"
     ask(question) if question
   end
@@ -349,7 +346,7 @@ class Gem::StreamUI
   # Display an error message in a location expected to get error messages.
   # Will ask +question+ if it is not nil.
 
-  def alert_error(statement, question=nil)
+  def alert_error(statement, question = nil)
     @errs.puts "ERROR:  #{statement}"
     ask(question) if question
   end

data/lib/rubygems/util.rb

@@ -1,7 +1,5 @@
 # frozen_string_literal: true
 
-require_relative "deprecate"
-
 ##
 # This module contains various utility methods as module methods.
 
@@ -56,26 +54,6 @@ module Gem::Util
     IO.popen command, &:read
   end
 
-  ##
-  # Invokes system, but silences all output.
-
-  def self.silent_system(*command)
-    opt = { out: IO::NULL, err: [:child, :out] }
-    if Hash === command.last
-      opt.update(command.last)
-      cmds = command[0...-1]
-    else
-      cmds = command.dup
-    end
-    system(*(cmds << opt))
-  end
-
-  class << self
-    extend Gem::Deprecate
-
-    rubygems_deprecate :silent_system
-  end
-
   ##
   # Enumerates the parents of +directory+.
 

data/lib/rubygems/validator.rb

@@ -59,7 +59,7 @@ class Gem::Validator
   #--
   # TODO needs further cleanup
 
-  def alien(gems=[])
+  def alien(gems = [])
     errors = Hash.new {|h,k| h[k] = {} }
 
     Gem::Specification.each do |spec|