rubygems-update 4.0.21 → 4.1.0.beta1

data/lib/rubygems/commands/push_command.rb

@@ -2,11 +2,13 @@
 
 require_relative "../command"
 require_relative "../local_remote_options"
+require_relative "../version_option"
 require_relative "../gemcutter_utilities"
 require_relative "../package"
 
 class Gem::Commands::PushCommand < Gem::Command
   include Gem::LocalRemoteOptions
+  include Gem::VersionOption
   include Gem::GemcutterUtilities
 
   def description # :nodoc:
@@ -17,7 +19,9 @@ https://rubygems.org) and adds it to the index.
 The gem can be removed from the index and deleted from the server using the yank
 command.  For further discussion see the help for the yank command.
 
-The push command will use ~/.gem/credentials to authenticate to a server, but you can use the RubyGems environment variable GEM_HOST_API_KEY to set the api key to authenticate.
+The push command will use ~/.gem/credentials to authenticate to a server, but you can use the RubyGems environment variable GEM_HOST_API_KEY to set the api key to authenticate. If the :credential_store: gemrc option (or RUBYGEMS_CREDENTIAL_STORE environment variable) is set, the API key is stored in and read from the credential store it selects instead of ~/.gem/credentials.
+
+The API key to send is resolved in this order: the GEM_HOST_API_KEY environment variable, the --key option, the host's own key in the credential store (when :credential_store: is set), the host's own key in ~/.gem/credentials, then the default RubyGems.org key from either place. The first one found is used.
     EOF
   end
 
@@ -45,8 +49,17 @@ The push command will use ~/.gem/credentials to authenticate to a server, but yo
       @user_defined_host = true
     end
 
+    add_option("--platform PLATFORM",
+               "Push a gem for a specific platform",
+               "  (e.g. x86_64-darwin-20)") do |value, options|
+      options[:platform] = value
+    end
+
+    add_ruby_abi_option("push", "  (e.g. 3.4)")
+
     add_option("--attestation FILE",
-                "Push with sigstore attestations") do |value, options|
+                "Push with sigstore attestations",
+                "  (FILE must be a JSON sigstore bundle)") do |value, options|
       options[:attestations] << value
     end
 
@@ -54,7 +67,12 @@ The push command will use ~/.gem/credentials to authenticate to a server, but yo
   end
 
   def execute
-    gem_name = get_one_gem_name
+    gem_name = if options[:platform] || options[:ruby_abi]
+      resolve_gem_name(get_all_gem_names)
+    else
+      get_one_gem_name
+    end
+
     default_gem_server, push_host = get_hosts_for(gem_name)
 
     @host = if @user_defined_host
@@ -91,24 +109,150 @@ The push command will use ~/.gem/credentials to authenticate to a server, but yo
 
   private
 
+  def resolve_gem_name(names)
+    platform = options[:platform] && Gem::Platform.new(options[:platform])
+    ruby_abi = options[:ruby_abi]
+
+    candidates = names.filter_map do |name|
+      [name, Gem::Package.new(name).spec]
+    rescue Gem::Package::FormatError => e
+      alert_warning "Skipping #{name}: #{e.message}"
+      nil
+    end
+
+    matches = candidates.select do |_, spec|
+      (!platform || spec.platform == platform) &&
+        (!ruby_abi || (Gem::ContentAddress.eligible?(spec) && spec.ruby_abi == ruby_abi))
+    end
+
+    raise Gem::CommandLineError, "No gem matched #{gem_name_selector_description}" if matches.empty?
+    raise Gem::CommandLineError, multiple_matches_message(matches) if matches.length > 1
+
+    matches.first.first
+  end
+
+  def gem_name_selector_description
+    selectors = []
+    selectors << "platform #{options[:platform]}" if options[:platform]
+    selectors << "Ruby ABI #{options[:ruby_abi]}" if options[:ruby_abi]
+    selectors.join(" and ")
+  end
+
+  def multiple_matches_message(matches)
+    message = "Multiple gems matched #{gem_name_selector_description}: #{matches.map(&:first).join(", ")}"
+
+    if options[:platform] && !options[:ruby_abi]
+      ruby_abis = matches.filter_map {|_, spec| spec.ruby_abi }.uniq.sort
+      message += "\nSpecify --ruby-abi with one of: #{ruby_abis.join(", ")}" unless ruby_abis.empty?
+      message += "\nTo push a gem without a Ruby ABI, pass the exact filename." if matches.any? {|_, spec| spec.ruby_abi.nil? }
+    elsif options[:ruby_abi] && !options[:platform]
+      platforms = matches.map {|_, spec| spec.platform.to_s }.uniq.sort
+      message += "\nSpecify --platform with one of: #{platforms.join(", ")}" unless platforms.empty?
+    end
+
+    message
+  end
+
   def send_push_request(name, args)
+    # Always honor explicit --attestation option
+    # Auto-attestation is only supported on rubygems.org with GitHub Actions (not JRuby)
+    if options[:attestations].any? || (RUBY_ENGINE != "jruby" && attestation_supported_host? && ENV["GITHUB_ACTIONS"] == "true")
+      send_push_request_with_attestation(name, args)
+    else
+      send_push_request_without_attestation(name, args)
+    end
+  end
+
+  def send_push_request_without_attestation(name, args)
     scope = get_push_scope
     rubygems_api_request(*args, scope: scope) do |request|
       body = Gem.read_binary name
-      if options[:attestations].any?
-        request.set_form([
-          ["gem", body, { filename: name, content_type: "application/octet-stream" }],
-          get_attestations_part,
-        ], "multipart/form-data")
-      else
-        request.body = body
-        request.add_field "Content-Type",   "application/octet-stream"
-        request.add_field "Content-Length", request.body.size
+      request.body = body
+      request.add_field "Content-Type",   "application/octet-stream"
+      request.add_field "Content-Length", request.body.size
+      request.add_field "Authorization", api_key
+    end
+  end
+
+  def send_push_request_with_attestation(name, args)
+    attestations = if options[:attestations].any?
+      options[:attestations].map do |attestation|
+        load_attestation(attestation)
+      end
+    else
+      # Only the opportunistic signing step falls back. The request below stays
+      # outside this rescue because once the server may have seen the attested
+      # push, a network error must not trigger an unattested retry.
+      begin
+        [attest!(name)]
+      rescue StandardError => e
+        message = "Failed to create an attestation, pushing without one.\n"
+        message += if Gem.configuration.really_verbose
+          e.full_message
+        else
+          e.message
+        end
+        alert_warning message
+        return send_push_request_without_attestation(name, args)
       end
+    end
+    bundles = "[" + attestations.join(",") + "]"
+
+    rubygems_api_request(*args, scope: get_push_scope) do |request|
+      request.set_form([
+        ["gem", Gem.read_binary(name), { filename: name, content_type: "application/octet-stream" }],
+        ["attestations", bundles, { content_type: "application/json" }],
+      ], "multipart/form-data")
       request.add_field "Authorization", api_key
     end
   end
 
+  def load_attestation(file)
+    data = begin
+      Gem.read_binary(file)
+    rescue SystemCallError, IOError, ArgumentError => e
+      raise Gem::Exception, "Failed to read attestation #{file}: #{e.message}"
+    end
+    validate_attestation_json(data, file)
+  end
+
+  def validate_attestation_json(data, source)
+    require "json"
+
+    parsed = begin
+      JSON.parse(data)
+    rescue JSON::ParserError => e
+      raise Gem::Exception, "Attestation #{source} is not valid JSON: #{e.message}"
+    end
+    raise Gem::Exception, "Attestation #{source} is not a JSON object" unless parsed.is_a?(Hash)
+    data
+  end
+
+  def attest!(name)
+    require "open3"
+    require "shellwords"
+    require "tempfile"
+
+    env = defined?(Bundler.unbundled_env) ? Bundler.unbundled_env : ENV.to_h
+
+    Tempfile.create([File.basename(name, ".*"), ".sigstore.json"]) do |tempfile|
+      tempfile.close
+      bundle = tempfile.path
+
+      # Gem.ruby is quoted if it contains whitespace, so split it into argv
+      # elements to keep the quotes out of the spawned command.
+      out, st = Open3.capture2e(
+        env,
+        *Shellwords.split(Gem.ruby), "-S", "gem", "exec", "--conservative",
+        "sigstore-cli", "sign", name, "--bundle", bundle,
+        unsetenv_others: true
+      )
+      raise Gem::Exception, "Failed to sign gem:\n\n#{out}" unless st.success?
+
+      validate_attestation_json(Gem.read_binary(bundle), "generated by sigstore-cli")
+    end
+  end
+
   def get_hosts_for(name)
     gem_metadata = Gem::Package.new(name).spec.metadata
 
@@ -122,14 +266,8 @@ The push command will use ~/.gem/credentials to authenticate to a server, but yo
     :push_rubygem
   end
 
-  def get_attestations_part
-    bundles = "[" + options[:attestations].map do |attestation|
-      Gem.read_binary(attestation)
-    end.join(",") + "]"
-    [
-      "attestations",
-      bundles,
-      { content_type: "application/json" },
-    ]
+  def attestation_supported_host?
+    host = (@host || Gem.host).to_s.chomp("/")
+    host == Gem::DEFAULT_HOST
   end
 end

data/lib/rubygems/commands/setup_command.rb

@@ -283,7 +283,6 @@ By default, this RubyGems will install gem as:
 
   def install_lib(lib_dir)
     libs = { "RubyGems" => "lib" }
-    libs["Bundler"] = "bundler/lib"
     libs.each do |tool, path|
       say "Installing #{tool}" if @verbose
 
@@ -371,7 +370,7 @@ By default, this RubyGems will install gem as:
     # the default gem will look for them.
     bundler_install_dir = File.dirname(File.dirname(specs_dir))
 
-    new_bundler_spec = Dir.chdir("bundler") { Gem::Specification.load("bundler.gemspec") }
+    new_bundler_spec = Gem::Specification.load("bundler.gemspec")
     full_name = new_bundler_spec.full_name
     gemspec_path = "#{full_name}.gemspec"
 
@@ -396,26 +395,24 @@ By default, this RubyGems will install gem as:
 
     require_relative "../installer"
 
-    Dir.chdir("bundler") do
-      built_gem = Gem::Package.build(new_bundler_spec)
-      begin
-        installer = Gem::Installer.at(
-          built_gem,
-          env_shebang: options[:env_shebang],
-          format_executable: options[:format_executable],
-          force: options[:force],
-          bin_dir: bin_dir,
-          install_dir: bundler_install_dir,
-          wrappers: true
-        )
-        # We only need to install the executables here. The default spec was
-        # already written above, and lib/bundler.rb and lib/bundler/* are
-        # available under the site_ruby directory.
-        installer.extract_bin
-        installer.generate_bin
-      ensure
-        FileUtils.rm_f built_gem
-      end
+    built_gem = Gem::Package.build(new_bundler_spec)
+    begin
+      installer = Gem::Installer.at(
+        built_gem,
+        env_shebang: options[:env_shebang],
+        format_executable: options[:format_executable],
+        force: options[:force],
+        bin_dir: bin_dir,
+        install_dir: bundler_install_dir,
+        wrappers: true
+      )
+      # We only need to install the executables here. The default spec was
+      # already written above, and lib/bundler.rb and lib/bundler/* are
+      # available under the site_ruby directory.
+      installer.extract_bin
+      installer.generate_bin
+    ensure
+      FileUtils.rm_f built_gem
     end
 
     new_bundler_spec.executables.each {|executable| bin_file_names << target_bin_path(bin_dir, executable) }
@@ -505,7 +502,7 @@ abort "#{deprecation_message}"
 
   def remove_old_lib_files(lib_dir)
     lib_dirs = { File.join(lib_dir, "rubygems") => "lib/rubygems" }
-    lib_dirs[File.join(lib_dir, "bundler")] = "bundler/lib/bundler"
+    lib_dirs[File.join(lib_dir, "bundler")] = "lib/bundler"
     lib_dirs.each do |old_lib_dir, new_lib_dir|
       lib_files = files_in(new_lib_dir)
 

data/lib/rubygems/commands/signin_command.rb

@@ -21,7 +21,9 @@ class Gem::Commands::SigninCommand < Gem::Command
     "The signin command executes host sign in for a push server (the default is"\
     " https://rubygems.org). The host can be provided with the host flag or can"\
     " be inferred from the provided gem. Host resolution matches the resolution"\
-    " strategy for the push command."
+    " strategy for the push command. If the :credential_store: gemrc option (or"\
+    " RUBYGEMS_CREDENTIAL_STORE environment variable) is set, the resulting API key is"\
+    " stored in the credential store it selects instead of ~/.gem/credentials."
   end
 
   def usage # :nodoc:

data/lib/rubygems/commands/signout_command.rb

@@ -9,7 +9,10 @@ class Gem::Commands::SignoutCommand < Gem::Command
 
   def description # :nodoc:
     "The `signout` command is used to sign out from all current sessions,"\
-    " allowing you to sign in using a different set of credentials."
+    " allowing you to sign in using a different set of credentials. It removes"\
+    " the ~/.gem/credentials file. If the :credential_store: gemrc option is"\
+    " set, it also removes every RubyGems key from the credential store,"\
+    " including keys saved for other hosts with `gem signin --host`."
   end
 
   def usage # :nodoc:
@@ -18,14 +21,31 @@ class Gem::Commands::SignoutCommand < Gem::Command
 
   def execute
     credentials_path = Gem.configuration.credentials_path
+    credentials_file_exists = File.exist?(credentials_path)
 
-    if !File.exist?(credentials_path)
+    if !credentials_file_exists && !Gem.configuration.credential_store
       alert_error "You are not currently signed in."
-    elsif !File.writable?(credentials_path)
-      alert_error "File '#{Gem.configuration.credentials_path}' is read-only."\
-                  " Please make sure it is writable."
+      return
+    end
+
+    # An unwritable file must not leave the stored keys behind, so each half
+    # reports its own outcome.
+    store_cleared, file_removed = Gem.configuration.unset_api_key!
+
+    unremoved = []
+    unremoved << "the credential store" unless store_cleared
+    unremoved << "'#{credentials_path}'" if credentials_file_exists && !file_removed
+
+    unless unremoved.empty?
+      alert_error "Could not remove the credentials from #{unremoved.join(" and ")}." \
+                  " They are still there. Check that the file and its directory are writable," \
+                  " or remove them yourself to finish signing out."
+      terminate_interaction 1
+    end
+
+    if Gem.configuration.credential_store
+      say "You have successfully signed out of every registry, including RubyGems.org."
     else
-      Gem.configuration.unset_api_key!
       say "You have successfully signed out from all sessions."
     end
   end

data/lib/rubygems/commands/specification_command.rb

@@ -147,7 +147,7 @@ Specific fields in the specification can be extracted in YAML format:
       say case options[:format]
           when :ruby then s.to_ruby
           when :marshal then Marshal.dump s
-          else s.to_yaml
+          else Gem.use_psych? ? s.to_yaml : Gem::YAMLSerializer.dump(s)
       end
 
       say "\n"

data/lib/rubygems/commands/uninstall_command.rb

@@ -117,7 +117,7 @@ that is a dependency of an existing gem.  You can use the
     if options[:version] != Gem::Requirement.default &&
        get_all_gem_names.size > 1
       alert_error "Can't use --version with multiple gems. You can specify multiple gems with" \
-                  " version requirements using `gem uninstall 'my_gem:1.0.0' 'my_other_gem:~>2.0.0'`"
+                  " version requirements using `gem uninstall 'my_gem:1.0.0' 'my_other_gem:>=2'`"
       terminate_interaction 1
     end
   end

data/lib/rubygems/commands/update_command.rb

@@ -2,6 +2,7 @@
 
 require_relative "../command"
 require_relative "../command_manager"
+require_relative "../cooldown"
 require_relative "../dependency_installer"
 require_relative "../install_update_options"
 require_relative "../local_remote_options"
@@ -95,8 +96,12 @@ command to remove old versions.
   end
 
   def execute
+    @cooldown = Gem::Cooldown.from_options options
+    @cooldown_skipped = []
+
     if options[:system]
       update_rubygems
+      output_cooldown_skipped_summary
       return
     end
 
@@ -132,6 +137,8 @@ command to remove old versions.
     end
     say "Gems already up-to-date: #{up_to_date_names.join(" ")}" unless up_to_date_names.empty?
     say "Gems not currently installed: #{not_installed_names.join(" ")}" unless not_installed_names.empty?
+
+    output_cooldown_skipped_summary
   end
 
   def fetch_remote_gems(spec) # :nodoc:
@@ -140,7 +147,12 @@ command to remove old versions.
 
     fetcher = Gem::SpecFetcher.fetcher
 
-    spec_tuples, errors = fetcher.search_for_dependency dependency
+    # The default indexes carry only the newest version of each gem, which
+    # leaves nothing to fall back to when the cooldown excludes it, so
+    # search the full index instead.
+    type = dependency.prerelease? ? :complete : :released if @cooldown&.active?
+
+    spec_tuples, errors = fetcher.search_for_dependency dependency, type: type
 
     error = errors.find {|e| e.respond_to? :exception }
 
@@ -167,12 +179,78 @@ command to remove old versions.
   def highest_remote_name_tuple(spec) # :nodoc:
     spec_tuples = fetch_remote_gems spec
 
-    highest_remote_gem = spec_tuples.max
+    highest_remote_gem = filter_cooldown_tuples(spec_tuples).max
     return unless highest_remote_gem
 
     highest_remote_gem.first
   end
 
+  ##
+  # Rejects [NameTuple, Gem::Source] pairs published within the cooldown
+  # period.  Tuples with an unknown publish time are kept, so the cooldown
+  # fails open.
+
+  def filter_cooldown_tuples(spec_tuples) # :nodoc:
+    return spec_tuples unless @cooldown&.active?
+
+    with_times = spec_tuples.map do |tup, source|
+      [tup, source, source.created_at_for_tuple(tup)]
+    end
+
+    if !with_times.empty? && with_times.none? {|_, _, created_at| created_at }
+      Gem::Cooldown.warn_missing_created_at with_times.first[1]
+    end
+
+    with_times.reject do |tup, _, created_at|
+      next false unless @cooldown.skip?(created_at)
+
+      (@cooldown_skipped_tuples ||= {})[[tup.name, tup.version]] ||= created_at
+      true
+    end.map {|tup, source, _| [tup, source] }
+  end
+
+  ##
+  # Summary entries for tuples the cooldown kept out of the update, kept
+  # only when newer than the version the update actually settled on (the
+  # updated version, or the one already installed when nothing moved).
+
+  def cooldown_skipped_tuple_entries # :nodoc:
+    skipped = @cooldown_skipped_tuples
+    return [] unless skipped
+
+    resolved = {}
+    @updated.each do |spec|
+      version = resolved[spec.name]
+      resolved[spec.name] = spec.version if version.nil? || spec.version > version
+    end
+
+    skipped.filter_map do |(name, version), created_at|
+      resolved_version = resolved[name] || resolved_fallback_version(name)
+      next unless resolved_version && version > resolved_version
+
+      {
+        name: name,
+        version: version,
+        resolved: resolved_version,
+        available_in_days: @cooldown.remaining_days(created_at),
+      }
+    end
+  end
+
+  def resolved_fallback_version(name) # :nodoc:
+    if name == "rubygems-update"
+      Gem::Version.new Gem::VERSION
+    else
+      Gem::Specification.find_all_by_name(name).map(&:version).max
+    end
+  end
+
+  def output_cooldown_skipped_summary # :nodoc:
+    entries = (@cooldown_skipped || []) + cooldown_skipped_tuple_entries
+
+    Gem::Cooldown.output_skipped_summary entries
+  end
+
   def install_rubygems(spec) # :nodoc:
     args = update_rubygems_arguments
     version = spec.version
@@ -256,6 +334,10 @@ command to remove old versions.
     @installer.installed_gems.each do |spec|
       @updated << spec
     end
+
+    (@cooldown_skipped ||= []).concat @installer.cooldown_skipped
+
+    @installer.installed_gems
   end
 
   def update_gems(gems_to_update)

data/lib/rubygems/commands/yank_command.rb

@@ -25,7 +25,7 @@ data you will need to change them immediately and yank your gem.
   end
 
   def usage # :nodoc:
-    "#{program_name} -v VERSION [-p PLATFORM] [--key KEY_NAME] [--host HOST] GEM"
+    "#{program_name} -v VERSION [-p PLATFORM] [--ruby-abi RUBY_ABI] [--key KEY_NAME] [--host HOST] GEM"
   end
 
   def initialize
@@ -33,6 +33,7 @@ data you will need to change them immediately and yank your gem.
 
     add_version_option("remove")
     add_platform_option("remove")
+    add_ruby_abi_option("remove")
     add_otp_option
 
     add_option("--host HOST",
@@ -50,20 +51,21 @@ data you will need to change them immediately and yank your gem.
 
     sign_in @host, scope: get_yank_scope
 
-    version   = get_version_from_requirements(options[:version])
-    platform  = get_platform_from_requirements(options)
+    version  = get_version_from_requirements(options[:version])
+    platform = get_platform_from_requirements(options)
+    ruby_abi = options[:ruby_abi]
 
     if version
-      yank_gem(version, platform)
+      yank_gem(version, platform, ruby_abi)
     else
       say "A version argument is required: #{usage}"
       terminate_interaction
     end
   end
 
-  def yank_gem(version, platform)
+  def yank_gem(version, platform, ruby_abi)
     say "Yanking gem from #{host}..."
-    args = [:delete, version, platform, "api/v1/gems/yank"]
+    args = [:delete, version, platform, ruby_abi, "api/v1/gems/yank"]
     response = yank_api_request(*args)
 
     say response.body
@@ -71,7 +73,7 @@ data you will need to change them immediately and yank your gem.
 
   private
 
-  def yank_api_request(method, version, platform, api)
+  def yank_api_request(method, version, platform, ruby_abi, api)
     name = get_one_gem_name
     response = rubygems_api_request(method, api, host, scope: get_yank_scope) do |request|
       request.add_field("Authorization", api_key)
@@ -81,6 +83,7 @@ data you will need to change them immediately and yank your gem.
         "version" => version,
       }
       data["platform"] = platform if platform
+      data["ruby_abi"] = ruby_abi if ruby_abi
 
       request.set_form_data data
     end