rubygems-update 4.0.21 → 4.1.0.beta1

data/{bundler/lib → lib}/bundler/cli/lock.rb

@@ -16,8 +16,7 @@ module Bundler
 
       check_for_conflicting_options
 
-      Bundler::CLI::Common.validate_cooldown!(options[:cooldown])
-      Bundler.settings.set_command_option_if_given :cooldown, options[:cooldown]
+      Bundler::CLI::Common.configure_cooldown(options)
 
       print = options[:print]
       previous_output_stream = Bundler.ui.output_stream

data/{bundler/lib → lib}/bundler/cli/outdated.rb

@@ -26,8 +26,7 @@ module Bundler
     def run
       check_for_deployment_mode!
 
-      Bundler::CLI::Common.validate_cooldown!(options[:cooldown])
-      Bundler.settings.set_command_option_if_given :cooldown, options[:cooldown]
+      Bundler::CLI::Common.configure_cooldown(options)
 
       Bundler.definition.validate_runtime!
       current_specs = Bundler.ui.silence { Bundler.definition.resolve }
@@ -77,7 +76,7 @@ module Bundler
         gemfile_specs + dependency_specs
       end
 
-      specs.sort_by(&:name).uniq(&:name).each do |current_spec|
+      specs_for_outdated_check(specs).each do |current_spec|
         next unless gems.empty? || gems.include?(current_spec.name)
 
         active_spec = retrieve_active_spec(definition, current_spec)
@@ -152,6 +151,12 @@ module Bundler
       end
     end
 
+    def specs_for_outdated_check(specs)
+      specs.group_by(&:name).values.filter_map do |matching_specs|
+        MatchPlatform.select_best_platform_match(matching_specs, Bundler.local_platform).first || matching_specs.first
+      end.sort_by(&:name)
+    end
+
     def retrieve_active_spec(definition, current_spec)
       active_spec = definition.resolve.find_by_name_and_platform(current_spec.name, current_spec.platform)
       return unless active_spec

data/{bundler/lib → lib}/bundler/cli/pristine.rb

@@ -25,7 +25,8 @@ module Bundler
           when Source::Rubygems
             cached_gem = spec.cache_file
             unless File.exist?(cached_gem)
-              Bundler.ui.error("Failed to pristine #{gem_name}. Cached gem #{cached_gem} does not exist.")
+              Bundler.ui.error("Failed to pristine #{gem_name}. Cached gem #{cached_gem} does not exist. " \
+                                "Run `bundle install --redownload` to download it again.")
               next
             end
 

data/{bundler/lib → lib}/bundler/cli/update.rb

@@ -13,9 +13,7 @@ module Bundler
 
       update_bundler = options[:bundler]
 
-      Bundler.self_manager.update_bundler_and_restart_with_it_if_needed(update_bundler, pre: options[:pre]) if update_bundler
-
-      Plugin.gemfile_install(Bundler.default_gemfile) if Bundler.settings[:plugins]
+      Bundler.self_manager.update_bundler_and_restart_with_it_if_needed(update_bundler) if update_bundler
 
       sources = Array(options[:source])
       groups  = Array(options[:group]).map(&:to_sym)
@@ -33,29 +31,39 @@ module Bundler
 
       conservative = options[:conservative]
 
-      if full_update
+      unlock = if full_update
         if conservative
-          Bundler.definition(conservative: conservative)
+          { conservative: conservative }
         else
-          Bundler.definition(true)
+          true
         end
       else
         unless Bundler.default_lockfile.exist?
           raise GemfileLockNotFound, "This Bundle hasn't been installed yet. " \
             "Run `bundle install` to update and install the bundled gems."
         end
-        Bundler::CLI::Common.ensure_all_gems_in_lockfile!(gems)
+        explicit_gems = gems.dup
 
         if groups.any?
           deps = Bundler.definition.dependencies.select {|d| (d.groups & groups).any? }
           gems.concat(deps.map(&:name))
         end
 
-        Bundler.definition(gems: gems, sources: sources, ruby: options[:ruby],
-                           conservative: conservative,
-                           bundler: update_bundler)
+        {
+          gems: gems,
+          sources: sources,
+          ruby: options[:ruby],
+          conservative: conservative,
+          bundler: update_bundler,
+        }
       end
 
+      Plugin.gemfile_install(Bundler.default_gemfile, Bundler.default_lockfile, unlock.dup) if Bundler.settings[:plugins]
+
+      Bundler::CLI::Common.ensure_all_gems_in_lockfile!(explicit_gems) if explicit_gems
+
+      Bundler.definition(unlock)
+
       Bundler::CLI::Common.configure_gem_version_promoter(Bundler.definition, options)
 
       Bundler::Fetcher.disable_endpoint = options["full-index"]
@@ -66,8 +74,7 @@ module Bundler
       opts["force"] = options[:redownload] if options[:redownload]
 
       Bundler.settings.set_command_option_if_given :jobs, opts["jobs"]
-      Bundler::CLI::Common.validate_cooldown!(options[:cooldown])
-      Bundler.settings.set_command_option_if_given :cooldown, options[:cooldown]
+      Bundler::CLI::Common.configure_cooldown(options)
 
       Bundler.definition.validate_runtime!
 
@@ -84,6 +91,8 @@ module Bundler
       if CLI::Common.clean_after_install?
         require_relative "clean"
         Bundler::CLI::Clean.new(options).run
+      else
+        CLI::Common.prune(options)
       end
 
       if locked_gems

data/{bundler/lib → lib}/bundler/cli.rb

@@ -276,10 +276,12 @@ module Bundler
     method_option "with", type: :array, banner: "Include gems that are part of the specified named group (removed)."
     method_option "cooldown", type: :numeric, banner: "Only consider gem versions published at least N days ago. Use 0 to disable."
     def install
-      %w[clean deployment frozen no-prune path shebang without with].each do |option|
+      %w[clean deployment frozen path shebang without with].each do |option|
         remembered_flag_deprecation(option)
       end
 
+      remembered_flag_deprecation("no-prune", option_name: "keep_outdated_cache")
+
       print_remembered_flag_deprecation("--system", "path.system", "true") if ARGV.include?("--system")
 
       remembered_flag_deprecation("deployment", negative: true)
@@ -317,7 +319,7 @@ module Bundler
     method_option "source", type: :array, banner: "Update a specific source (and all gems associated with it)"
     method_option "force", type: :boolean, aliases: "--redownload", banner: "Force reinstalling every gem, even if already installed"
     method_option "ruby", type: :boolean, banner: "Update ruby specified in Gemfile.lock"
-    method_option "bundler", type: :string, lazy_default: ">= #{Bundler::VERSION}", banner: "Update the locked version of bundler"
+    method_option "bundler", type: :string, lazy_default: "> 0.a", banner: "Update the locked version of bundler"
     method_option "patch", type: :boolean, banner: "Prefer updating only to next patch version"
     method_option "minor", type: :boolean, banner: "Prefer updating only to next minor version"
     method_option "major", type: :boolean, banner: "Prefer updating to next major version (default)"
@@ -405,7 +407,8 @@ module Bundler
     method_option "glob", type: :string, banner: "The location of a dependency's .gemspec, expanded within Ruby (single quotes recommended)"
     method_option "quiet", type: :boolean, banner: "Only output warnings and errors."
     method_option "skip-install", type: :boolean, banner: "Adds gem to the Gemfile but does not install it"
-    method_option "optimistic", type: :boolean, banner: "Adds optimistic declaration of version to gem"
+    method_option "optimistic", type: :boolean, banner: "Ignored (now default behavior)"
+    method_option "pessimistic", type: :boolean, banner: "Adds pessimistic declaration of version to gem"
     method_option "strict", type: :boolean, banner: "Adds strict declaration of version to gem"
     method_option "cooldown", type: :numeric, banner: "Only consider gem versions published at least N days ago. Use 0 to disable."
     def add(*gems)
@@ -472,9 +475,8 @@ module Bundler
       print_remembered_flag_deprecation("--all", "cache_all", "true") if ARGV.include?("--all")
       print_remembered_flag_deprecation("--no-all", "cache_all", "false") if ARGV.include?("--no-all")
 
-      %w[frozen no-prune].each do |option|
-        remembered_flag_deprecation(option)
-      end
+      remembered_flag_deprecation("frozen")
+      remembered_flag_deprecation("no-prune", option_name: "keep_outdated_cache")
 
       if flag_passed?("--path")
         removed_message =
@@ -642,7 +644,7 @@ module Bundler
     method_option "pre", type: :boolean, banner: "If updating, always choose the highest allowed version, regardless of prerelease status"
     method_option "strict", type: :boolean, banner: "If updating, do not allow any gem to be updated past latest --patch | --minor | --major"
     method_option "conservative", type: :boolean, banner: "If updating, use bundle install conservative update behavior and do not allow shared dependencies to be updated"
-    method_option "bundler", type: :string, lazy_default: ">= #{Bundler::VERSION}", banner: "Update the locked version of bundler"
+    method_option "bundler", type: :string, lazy_default: "> 0.a", banner: "Update the locked version of bundler"
     method_option "cooldown", type: :numeric, banner: "Only consider gem versions published at least N days ago. Use 0 to disable."
     def lock
       require_relative "cli/lock"
@@ -759,9 +761,6 @@ module Bundler
       config[:current_command] = original_command
     end
 
-    def current_command=(command)
-    end
-
     def print_command
       return unless Bundler.ui.debug?
       cmd = current_command
@@ -787,9 +786,13 @@ module Bundler
       return unless SharedHelpers.md5_available?
 
       require_relative "vendored_uri"
+      require "rubygems/compact_index_client"
+      if Gem::CompactIndexClient.respond_to?(:filesystem_access=)
+        Gem::CompactIndexClient.filesystem_access = SharedHelpers.method(:filesystem_access)
+      end
       remote = Source::Rubygems::Remote.new(Gem::URI("https://rubygems.org"))
       cache_path = Bundler.user_cache.join("compact_index", remote.cache_slug)
-      latest = Bundler::CompactIndexClient.new(cache_path).latest_version("bundler")
+      latest = Gem::CompactIndexClient.new(cache_path).latest_version("bundler")
       return unless latest
 
       current = Gem::Version.new(VERSION)

data/{bundler/lib → lib}/bundler/definition.rb

@@ -10,13 +10,14 @@ module Bundler
       attr_accessor :no_lock
     end
 
-    attr_writer :lockfile
+    attr_writer :lockfile, :overrides
 
     attr_reader(
       :dependencies,
       :locked_checksums,
       :locked_deps,
       :locked_gems,
+      :overrides,
       :platforms,
       :ruby_version,
       :lockfile,
@@ -37,7 +38,10 @@ module Bundler
 
       raise GemfileNotFound, "#{gemfile} not found" unless gemfile.file?
 
-      Dsl.evaluate(gemfile, lockfile, unlock)
+      Plugin.hook(Plugin::Events::GEM_BEFORE_EVAL, gemfile, lockfile)
+      Dsl.evaluate(gemfile, lockfile, unlock).tap do |definition|
+        Plugin.hook(Plugin::Events::GEM_AFTER_EVAL, definition)
+      end
     end
 
     #
@@ -58,7 +62,7 @@ module Bundler
     #   to be updated or true if all gems should be updated
     # @param ruby_version [Bundler::RubyVersion, nil] Requested Ruby Version
     # @param optional_groups [Array(String)] A list of optional groups
-    def initialize(lockfile, dependencies, sources, unlock, ruby_version = nil, optional_groups = [], gemfiles = [])
+    def initialize(lockfile, dependencies, sources, unlock, ruby_version = nil, optional_groups = [], gemfiles = [], overrides = [])
       unlock ||= {}
 
       if unlock == true
@@ -88,6 +92,7 @@ module Bundler
       @specs           = nil
       @ruby_version    = ruby_version
       @gemfiles        = gemfiles
+      @overrides       = overrides
 
       @lockfile               = lockfile
       @lockfile_contents      = String.new
@@ -109,6 +114,7 @@ module Bundler
         @locked_bundler_version = @locked_gems.bundler_version
         @locked_ruby_version = @locked_gems.ruby_version
         @locked_deps = @locked_gems.dependencies
+        Override.attach(@locked_gems.specs, @overrides)
         @originally_locked_specs = SpecSet.new(@locked_gems.specs)
         @originally_locked_sources = @locked_gems.sources
         @locked_checksums = @locked_gems.checksums
@@ -192,7 +198,7 @@ module Bundler
 
       sources.cached!
 
-      if options[:add_checksums] || (!options[:local] && (install_needed? || @locked_spec_with_empty_checksums))
+      if options[:add_checksums] || (!options[:local] && (install_needed? || refetch_needed?(options)))
         sources.remote!
         true
       else
@@ -509,12 +515,6 @@ module Bundler
                 "Your Ruby version is #{actual}, but your Gemfile specified #{expected}"
               when :engine_version
                 "Your #{Bundler::RubyVersion.system.engine} version is #{actual}, but your Gemfile specified #{ruby_version.engine} #{expected}"
-              when :patchlevel
-                if !expected.is_a?(String)
-                  "The Ruby patchlevel in your Gemfile must be a string"
-                else
-                  "Your Ruby patchlevel is #{actual}, but your Gemfile specified #{expected}"
-                end
         end
 
         raise RubyVersionMismatch, msg
@@ -627,6 +627,17 @@ module Bundler
       resolve_needed? || missing_specs?
     end
 
+    # Reinstalling installs from the cached archive, and `bundle cache` copies it
+    # into the app cache, so a cache emptied by the `prune` setting or by hand has
+    # to go back to the remotes to refill it.
+    def refetch_needed?(options)
+      return false unless options[:force] || options["cache-archives"]
+
+      resolve.for(requested_dependencies, [Bundler.local_platform]).any? do |spec|
+        spec.source.is_a?(Source::Rubygems) && spec.source.uncached?(spec)
+      end
+    end
+
     def something_changed?
       return true unless lockfile_exists?
 
@@ -639,7 +650,7 @@ module Bundler
         @missing_lockfile_dep ||
         @unlocking_bundler ||
         @locked_spec_with_missing_checksums ||
-        empty_checksums_actionable? ||
+        @locked_spec_with_empty_checksums ||
         @locked_spec_with_missing_deps ||
         @locked_spec_with_invalid_deps
     end
@@ -648,16 +659,6 @@ module Bundler
       unlocking? || something_changed?
     end
 
-    # Only a remote fetch can fill an empty CHECKSUMS entry, so it justifies a
-    # resolution only when one is coming. Resolving locally for it would repeat
-    # on every `Bundler.setup` without changing the lockfile. Frozen mode still
-    # has to refuse the entry.
-    def empty_checksums_actionable?
-      return false unless @locked_spec_with_empty_checksums
-
-      Bundler.frozen_bundle? || !sources.local_mode?
-    end
-
     def should_add_extra_platforms?
       !lockfile_exists? && Bundler::MatchPlatform.generic_local_platform_is_ruby? && !Bundler.settings[:force_ruby_platform]
     end
@@ -671,7 +672,20 @@ module Bundler
     end
 
     def expanded_dependencies
-      dependencies_with_bundler + metadata_dependencies
+      apply_overrides_to(dependencies_with_bundler) + metadata_dependencies
+    end
+
+    def apply_overrides_to(deps)
+      return deps if @overrides.empty?
+      deps.map {|dep| apply_override_to(dep) }
+    end
+
+    def apply_override_to(dep)
+      override = Override.find_for(@overrides, dep.name, :version)
+      return dep unless override
+      new_dep = dep.dup
+      new_dep.instance_variable_set(:@requirement, override.apply_to(dep.requirement))
+      new_dep
     end
 
     def dependencies_with_bundler
@@ -1070,7 +1084,7 @@ module Bundler
               @locked_specs.delete(locked_specs.select {|s| s.source != dep.source })
             end
 
-            unless dep.matches_spec?(locked_specs.first)
+            unless apply_override_to(dep).matches_spec?(locked_specs.first)
               @gems_to_unlock << name
               dep_changed = true
             end
@@ -1080,9 +1094,32 @@ module Bundler
         @changed_dependencies << name if dep_changed
       end
 
+      converge_overrides_outside_dependencies
+
       @changed_dependencies.any?
     end
 
+    def converge_overrides_outside_dependencies
+      @overrides.each do |override|
+        # :all overrides are intentionally not pre-unlocked. They take effect on
+        # fresh resolution (no lockfile) or when the user runs `bundle update`.
+        # Forcing a full re-resolve from a single :all directive would surprise
+        # users with unrelated dependency churn.
+        next unless override.target.is_a?(String)
+
+        name = override.target
+        next if @changed_dependencies.include?(name)
+        next if @originally_locked_specs[name].empty?
+        # version: overrides on direct deps are detected in the per-dep
+        # converge_dependencies loop via apply_override_to + matches_spec?.
+        # Other fields are not visible there, so they always reach here.
+        next if override.field == :version && @dependencies.any? {|d| d.name == name }
+
+        @gems_to_unlock << name
+        @changed_dependencies << name
+      end
+    end
+
     # Remove elements from the locked specs that are expired. This will most
     # commonly happen if the Gemfile has changed since the lockfile was last
     # generated
@@ -1318,7 +1355,7 @@ module Bundler
 
     def new_resolution_base(last_resolve:, unlock:)
       new_resolution_platforms = @current_platform_missing ? @new_platforms + [Bundler.local_platform] : @new_platforms
-      Resolver::Base.new(source_requirements, expanded_dependencies, last_resolve, @platforms, locked_specs: @originally_locked_specs, unlock: unlock, prerelease: gem_version_promoter.pre?, prefer_local: @prefer_local, new_platforms: new_resolution_platforms, explicit_unlocks: @explicit_unlocks)
+      Resolver::Base.new(source_requirements, expanded_dependencies, last_resolve, @platforms, locked_specs: @originally_locked_specs, unlock: unlock, prerelease: gem_version_promoter.pre?, prefer_local: @prefer_local, new_platforms: new_resolution_platforms, overrides: @overrides, explicit_unlocks: @explicit_unlocks)
     end
 
     def new_resolver(base)

data/{bundler/lib → lib}/bundler/dependency.rb

@@ -118,6 +118,10 @@ module Bundler
       !gemspec_dev_dep?
     end
 
+    def plugin?
+      @plugin ||= @options.fetch("plugin", false)
+    end
+
     def current_env?
       return true unless env
       if env.is_a?(Hash)

data/{bundler/lib → lib}/bundler/dsl.rb

@@ -22,7 +22,7 @@ module Bundler
     GITHUB_PULL_REQUEST_URL = %r{\Ahttps://github\.com/([A-Za-z0-9_\-\.]+/[A-Za-z0-9_\-\.]+)/pull/(\d+)\z}
     GITLAB_MERGE_REQUEST_URL = %r{\Ahttps://gitlab\.com/([A-Za-z0-9_\-\./]+)/-/merge_requests/(\d+)\z}
 
-    attr_reader :gemspecs, :gemfile
+    attr_reader :gemspecs, :gemfile, :overrides
     attr_accessor :dependencies
 
     def initialize
@@ -40,6 +40,7 @@ module Bundler
       @gemfile              = nil
       @gemfiles             = []
       @lockfile             = nil
+      @overrides            = []
       add_git_sources
     end
 
@@ -123,9 +124,15 @@ module Bundler
 
       if options.key?("type")
         options["type"] = options["type"].to_s
-        unless Plugin.source?(options["type"])
+        unless (source_plugin = Plugin.source_plugin(options["type"]))
           raise InvalidOption, "No plugin sources available for #{options["type"]}"
         end
+        # Implicitly add a dependency on source plugins who are named bundler-source-<type>,
+        # and aren't already mentioned in the Gemfile.
+        # See also Plugin::DSL#source
+        if source_plugin.start_with?("bundler-source-") && !@dependencies.any? {|d| d.name == source_plugin }
+          plugin(source_plugin)
+        end
 
         unless block_given?
           raise InvalidOption, "You need to pass a block to #source with :type option"
@@ -188,10 +195,32 @@ module Bundler
       with_source(git_source) { yield }
     end
 
+    SUPPORTED_OVERRIDE_FIELDS = [:version, :required_ruby_version, :required_rubygems_version].freeze
+    SUPPORTED_OVERRIDE_SYMBOL_OPERATIONS = [:ignore_upper].freeze
+
+    def override(target, **operations)
+      validate_override_target!(target)
+
+      if target == :all && operations.key?(:version)
+        raise ArgumentError, "`override :all, version:` is not allowed; version requirements are per-gem"
+      end
+
+      operations.each do |field, operation|
+        validate_override_field!(field)
+        validate_override_operation!(operation)
+        validate_override_uniqueness!(target, field)
+      end
+
+      source_location = caller_locations(1, 1)&.first
+      operations.each do |field, operation|
+        @overrides << Override.new(target, field, operation, source_location: source_location)
+      end
+    end
+
     def to_definition(lockfile, unlock)
       check_primary_source_safety
       lockfile = @lockfile unless @lockfile.nil?
-      Definition.new(lockfile, @dependencies, @sources, unlock, @ruby_version, @optional_groups, @gemfiles)
+      Definition.new(lockfile, @dependencies, @sources, unlock, @ruby_version, @optional_groups, @gemfiles, @overrides)
     end
 
     def group(*args, &blk)
@@ -233,8 +262,15 @@ module Bundler
       @env = old
     end
 
-    def plugin(*args)
-      # Pass on
+    def plugin(name, *args)
+      options = args.last.is_a?(Hash) ? args.pop.dup : {}
+      version = args || [">= 0"]
+
+      normalize_options(name, version, options)
+      options["plugin"] = true
+      options["require"] = false
+
+      add_dependency(name, version, options)
     end
 
     def method_missing(name, *args)
@@ -248,6 +284,39 @@ module Bundler
 
     private
 
+    def validate_override_target!(target)
+      return if target == :all
+      return if target.is_a?(String)
+      raise ArgumentError, "override target must be :all or a gem name string, got #{target.inspect}"
+    end
+
+    def validate_override_field!(field)
+      return if SUPPORTED_OVERRIDE_FIELDS.include?(field)
+      supported = SUPPORTED_OVERRIDE_FIELDS.map {|f| "`#{f}:`" }.join(", ")
+      raise ArgumentError, "unsupported override field `#{field}:`; supported fields: #{supported}"
+    end
+
+    def validate_override_operation!(operation)
+      case operation
+      when String
+        Gem::Requirement.new(operation)
+      when nil
+        # ok
+      when Symbol
+        return if SUPPORTED_OVERRIDE_SYMBOL_OPERATIONS.include?(operation)
+        raise ArgumentError, "unsupported override operation: #{operation.inspect}"
+      else
+        raise ArgumentError, "override operation must be a String, Symbol, or nil, got #{operation.inspect}"
+      end
+    rescue Gem::Requirement::BadRequirementError => e
+      raise ArgumentError, "invalid override version requirement #{operation.inspect}: #{e.message}"
+    end
+
+    def validate_override_uniqueness!(target, field)
+      return unless @overrides.any? {|o| o.target == target && o.field == field }
+      raise ArgumentError, "duplicate override for #{target.inspect} `#{field}:`"
+    end
+
     def add_dependency(name, version = nil, options = {})
       options["gemfile"] = @gemfile
       options["source"] ||= @source
@@ -262,13 +331,10 @@ module Bundler
 
           gemspec_dep = [dep, current].find(&:gemspec_dev_dep?)
           if gemspec_dep
-            require_relative "vendor/pub_grub/lib/pub_grub/version_range"
-            require_relative "vendor/pub_grub/lib/pub_grub/version_constraint"
-            require_relative "vendor/pub_grub/lib/pub_grub/version_union"
-            require_relative "vendor/pub_grub/lib/pub_grub/rubygems"
+            require_relative "vendored_pub_grub"
 
-            current_gemspec_range = PubGrub::RubyGems.requirement_to_range(current.requirement)
-            next_gemspec_range = PubGrub::RubyGems.requirement_to_range(dep.requirement)
+            current_gemspec_range = Gem::PubGrub::RubyGems.requirement_to_range(current.requirement)
+            next_gemspec_range = Gem::PubGrub::RubyGems.requirement_to_range(dep.requirement)
 
             if current_gemspec_range.intersects?(next_gemspec_range)
               dep = Dependency.new(name, current.requirement.as_list + dep.requirement.as_list, options)

data/{bundler/lib → lib}/bundler/endpoint_specification.rb

@@ -5,24 +5,33 @@ module Bundler
   class EndpointSpecification < Gem::Specification
     include MatchRemoteMetadata
 
-    attr_reader :name, :version, :platform, :checksum, :created_at
+    attr_reader :name, :version, :platform, :checksum, :created_at, :content_address
     attr_writer :dependencies
     attr_accessor :remote, :locked_platform
 
-    def initialize(name, version, platform, spec_fetcher, dependencies, metadata = nil)
+    def initialize(name, version, suffix, spec_fetcher, dependencies, metadata = nil)
       super()
       @name         = name
       @version      = Gem::Version.create version
-      @platform     = Gem::Platform.new(platform)
       @spec_fetcher = spec_fetcher
       @dependencies = nil
       @unbuilt_dependencies = dependencies
+      @content_address = nil
+      @required_platform = nil
 
       @loaded_from          = nil
       @remote_specification = nil
       @locked_platform = nil
 
       parse_metadata(metadata)
+
+      if Gem::ContentAddress.content_addressed_row?(suffix, @required_platform, @required_ruby_version)
+        @content_address = suffix
+        @platform = @required_platform
+        @required_rubygems_version ||= Gem::Requirement.default
+      else
+        @platform = Gem::Platform.new(suffix)
+      end
     end
 
     def insecurely_materialized?
@@ -147,18 +156,21 @@ module Bundler
     private
 
     def _remote_specification
-      @_remote_specification ||= @spec_fetcher.fetch_spec([@name, @version, @platform])
+      suffix = @content_address || @platform
+      @_remote_specification ||= @spec_fetcher.fetch_spec([@name, @version, suffix])
     end
 
     def local_specification_path
-      "#{base_dir}/specifications/#{full_name}.gemspec"
+      File.join(Gem::SpecificationRecord.specification_dir_for(self, base_dir),
+                "#{full_name}.gemspec")
     end
 
     def parse_metadata(data)
+      @created_at = nil
+
       unless data
         @required_ruby_version = nil
         @required_rubygems_version = nil
-        @created_at = nil
         return
       end
 
@@ -181,22 +193,47 @@ module Bundler
         when "ruby"
           @required_ruby_version = Gem::Requirement.new(v)
         when "created_at"
-          value = v.is_a?(Array) ? v.last : v
-          if value.is_a?(String)
-            @created_at = begin
-              Time.new(value)
-            rescue ArgumentError
-              nil
-            end
-          end
+          @created_at = parse_created_at(v.is_a?(Array) ? v.last : v)&.freeze
+        when "platform"
+          @required_platform = required_platform_from(Array(v).last)
         end
       end
     rescue StandardError => e
       raise GemspecError, "There was an error parsing the metadata for the gem #{name} (#{version}): #{e.class}\n#{e}\nThe metadata was #{data.inspect}"
     end
 
+    # Matches an ISO 8601 time zone designator at the end of a timestamp.
+    TIME_ZONE_SUFFIX = /(?:Z|z|[+-]\d{2}(?::?\d{2})?)\z/
+    private_constant :TIME_ZONE_SUFFIX
+
+    # See Gem::Cooldown::FOUR_DIGIT_YEAR.
+    FOUR_DIGIT_YEAR = /\A\d{4}-/
+    private_constant :FOUR_DIGIT_YEAR
+
+    # A timestamp without a time zone offset is read as UTC, because reading
+    # it as local time would shift the cooldown window by the environment's
+    # offset. Unparsable values and years outside four digits become nil so
+    # the cooldown fails open.
+    def parse_created_at(value)
+      return unless value.is_a?(String) && value.match?(FOUR_DIGIT_YEAR)
+
+      require "time"
+      begin
+        Time.iso8601(value.match?(TIME_ZONE_SUFFIX) ? value : "#{value}Z")
+      rescue ArgumentError
+        nil
+      end
+    end
+
     def build_dependency(name, requirements)
       Dependency.new(name, requirements)
     end
+
+    def required_platform_from(value)
+      value = value.to_s
+      return if value.empty?
+
+      Gem::Platform.new(value)
+    end
   end
 end