[rubygems/rubygems] Fix corrupted lockfile when using `gemspec` and multiple sources

https://github.com/rubygems/rubygems/commit/9712262d90

3 files changed, 80 insertions, 3 deletions

diff --git a/lib/bundler/definition.rb b/lib/bundler/definition.rb
index 77f065c5c7..20b5340203 100644
--- a/lib/bundler/definition.rb
+++ b/lib/bundler/definition.rb
@@ -786,6 +786,7 @@ module Bundler
       else
         { :default => Source::RubygemsAggregate.new(sources, source_map) }.merge(source_map.direct_requirements)
       end
+      source_requirements.merge!(source_map.locked_requirements) unless @remote
       metadata_dependencies.each do |dep|
         source_requirements[dep.name] = sources.metadata_source
       end
@@ -832,7 +833,7 @@ module Bundler
     end
 
     def source_map
-      @source_map ||= SourceMap.new(sources, dependencies)
+      @source_map ||= SourceMap.new(sources, dependencies, @locked_specs)
     end
   end
 end
diff --git a/lib/bundler/source_map.rb b/lib/bundler/source_map.rb
index a554f26f76..ca73e01f9d 100644
--- a/lib/bundler/source_map.rb
+++ b/lib/bundler/source_map.rb
@@ -2,11 +2,12 @@
 
 module Bundler
   class SourceMap
-    attr_reader :sources, :dependencies
+    attr_reader :sources, :dependencies, :locked_specs
 
-    def initialize(sources, dependencies)
+    def initialize(sources, dependencies, locked_specs)
       @sources = sources
       @dependencies = dependencies
+      @locked_specs = locked_specs
     end
 
     def pinned_spec_names(skip = nil)
@@ -54,5 +55,17 @@ module Bundler
         requirements
       end
     end
+
+    def locked_requirements
+      @locked_requirements ||= begin
+        requirements = {}
+        locked_specs.each do |locked_spec|
+          source = locked_spec.source
+          source.add_dependency_names(locked_spec.name)
+          requirements[locked_spec.name] = source
+        end
+        requirements
+      end
+    end
   end
 end
diff --git a/spec/bundler/commands/check_spec.rb b/spec/bundler/commands/check_spec.rb
index e0c9a04c25..b4996977c1 100644
--- a/spec/bundler/commands/check_spec.rb
+++ b/spec/bundler/commands/check_spec.rb
@@ -431,6 +431,69 @@ RSpec.describe "bundle check" do
     end
   end
 
+  context "with gemspec directive and scoped sources" do
+    before do
+      build_repo4 do
+        build_gem "awesome_print"
+      end
+
+      build_repo2 do
+        build_gem "dex-dispatch-engine"
+      end
+
+      build_lib("bundle-check-issue", :path => tmp.join("bundle-check-issue")) do |s|
+        s.write "Gemfile", <<-G
+          source "https://localgemserver.test"
+
+          gemspec
+
+          source "https://localgemserver.test/extra" do
+            gem "dex-dispatch-engine"
+          end
+        G
+
+        s.add_dependency "awesome_print"
+      end
+
+      bundle "install", :artifice => "compact_index_extra", :env => { "BUNDLER_SPEC_GEM_REPO" => gem_repo4.to_s }, :dir => tmp.join("bundle-check-issue")
+    end
+
+    it "does not corrupt lockfile when changing version" do
+      version_file = tmp.join("bundle-check-issue/bundle-check-issue.gemspec")
+      File.write(version_file, File.read(version_file).gsub(/s\.version = .+/, "s.version = '9999'"))
+
+      bundle "check --verbose", :dir => tmp.join("bundle-check-issue")
+
+      expect(File.read(tmp.join("bundle-check-issue/Gemfile.lock"))).to eq <<~L
+        PATH
+          remote: .
+          specs:
+            bundle-check-issue (9999)
+              awesome_print
+
+        GEM
+          remote: https://localgemserver.test/
+          specs:
+            awesome_print (1.0)
+
+        GEM
+          remote: https://localgemserver.test/extra/
+          specs:
+            dex-dispatch-engine (1.0)
+
+        PLATFORMS
+          #{lockfile_platforms}
+
+        DEPENDENCIES
+          bundle-check-issue!
+          dex-dispatch-engine!
+
+        BUNDLED WITH
+           #{Bundler::VERSION}
+      L
+    end
+  end
+
   describe "BUNDLED WITH" do
     def lock_with(bundler_version = nil)
       lock = <<~L