[rubygems/rubygems] Converts Bundler lockfile checksum validation to opt-in only

Looks for the CHECKSUMS section in the lockfile, activating the feature
only if the section exists. Without a CHECKSUMS section, Bundler will
continue as normal, validating checksums when gems are installed while
checksums from the compact index are present.

https://github.com/rubygems/rubygems/commit/2353cc93a4

1 files changed, 22 insertions, 36 deletions

diff --git a/spec/bundler/install/gemfile/platform_spec.rb b/spec/bundler/install/gemfile/platform_spec.rb
index 918a49e1e1..d4bbecfe04 100644
--- a/spec/bundler/install/gemfile/platform_spec.rb
+++ b/spec/bundler/install/gemfile/platform_spec.rb
@@ -203,6 +203,15 @@ RSpec.describe "bundle install across platforms" do
       gem "pry"
     G
 
+    checksums = checksums_section_when_existing do |c|
+      c.checksum gem_repo4, "coderay", "1.1.2"
+      c.checksum gem_repo4, "empyrean", "0.1.0"
+      c.checksum gem_repo4, "ffi", "1.9.23", "java"
+      c.checksum gem_repo4, "method_source", "0.9.0"
+      c.checksum gem_repo4, "pry", "0.11.3", "java"
+      c.checksum gem_repo4, "spoon", "0.0.6"
+    end
+
     expect(lockfile).to eq <<~L
       GEM
         remote: #{file_uri_for(gem_repo4)}/
@@ -224,15 +233,7 @@ RSpec.describe "bundle install across platforms" do
       DEPENDENCIES
         empyrean (= 0.1.0)
         pry
-
-      CHECKSUMS
-        #{checksum_for_repo_gem gem_repo4, "coderay", "1.1.2"}
-        #{checksum_for_repo_gem gem_repo4, "empyrean", "0.1.0"}
-        #{checksum_for_repo_gem gem_repo4, "ffi", "1.9.23", "java"}
-        #{checksum_for_repo_gem gem_repo4, "method_source", "0.9.0"}
-        #{checksum_for_repo_gem gem_repo4, "pry", "0.11.3", "java"}
-        #{checksum_for_repo_gem gem_repo4, "spoon", "0.0.6"}
-
+      #{checksums}
       BUNDLED WITH
          #{Bundler::VERSION}
     L
@@ -264,16 +265,7 @@ RSpec.describe "bundle install across platforms" do
       DEPENDENCIES
         empyrean (= 0.1.0)
         pry
-
-      CHECKSUMS
-        #{checksum_for_repo_gem gem_repo4, "coderay", "1.1.2"}
-        #{checksum_for_repo_gem gem_repo4, "empyrean", "0.1.0"}
-        #{checksum_for_repo_gem gem_repo4, "ffi", "1.9.23", "java"}
-        #{checksum_for_repo_gem gem_repo4, "method_source", "0.9.0"}
-        pry (0.11.3)
-        #{checksum_for_repo_gem gem_repo4, "pry", "0.11.3", "java"}
-        #{checksum_for_repo_gem gem_repo4, "spoon", "0.0.6"}
-
+      #{checksums}
       BUNDLED WITH
          #{Bundler::VERSION}
     L
@@ -306,15 +298,7 @@ RSpec.describe "bundle install across platforms" do
       DEPENDENCIES
         empyrean (= 0.1.0)
         pry
-
-      CHECKSUMS
-        #{checksum_for_repo_gem gem_repo4, "coderay", "1.1.2"}
-        #{checksum_for_repo_gem gem_repo4, "empyrean", "0.1.0"}
-        #{checksum_for_repo_gem gem_repo4, "ffi", "1.9.23", "java"}
-        #{checksum_for_repo_gem gem_repo4, "method_source", "0.9.0"}
-        #{checksum_for_repo_gem gem_repo4, "pry", "0.11.3", "java"}
-        #{checksum_for_repo_gem gem_repo4, "spoon", "0.0.6"}
-
+      #{checksums}
       BUNDLED WITH
          1.16.1
     L
@@ -388,6 +372,11 @@ RSpec.describe "bundle install across platforms" do
   end
 
   it "keeps existing platforms when installing with force_ruby_platform" do
+    checksums = checksums_section do |c|
+      c.no_checksum "platform_specific", "1.0"
+      c.no_checksum "platform_specific", "1.0", "java"
+    end
+
     lockfile <<-G
       GEM
         remote: #{file_uri_for(gem_repo1)}/
@@ -399,6 +388,7 @@ RSpec.describe "bundle install across platforms" do
 
       DEPENDENCIES
         platform_specific
+      #{checksums}
     G
 
     bundle "config set --local force_ruby_platform true"
@@ -408,6 +398,8 @@ RSpec.describe "bundle install across platforms" do
       gem "platform_specific"
     G
 
+    checksums.checksum gem_repo1, "platform_specific", "1.0"
+
     expect(the_bundle).to include_gem "platform_specific 1.0 RUBY"
 
     expect(lockfile).to eq <<~G
@@ -423,11 +415,7 @@ RSpec.describe "bundle install across platforms" do
 
       DEPENDENCIES
         platform_specific
-
-      CHECKSUMS
-        #{checksum_for_repo_gem(gem_repo1, "platform_specific", "1.0")}
-        #{gem_no_checksum "platform_specific", "1.0", "java"}
-
+      #{checksums}
       BUNDLED WITH
          #{Bundler::VERSION}
     G
@@ -596,9 +584,7 @@ RSpec.describe "bundle install with platform conditionals" do
 
       DEPENDENCIES
         rack
-
-      CHECKSUMS
-
+      #{checksums_section_when_existing}
       BUNDLED WITH
          #{Bundler::VERSION}
     L