Merge RubyGems-3.2.11 and Bundler-2.2.11

2 files changed, 102 insertions, 184 deletions

diff --git a/spec/bundler/install/gemfile/gemspec_spec.rb b/spec/bundler/install/gemfile/gemspec_spec.rb
index 4001df26da..7a95a8abde 100644
--- a/spec/bundler/install/gemfile/gemspec_spec.rb
+++ b/spec/bundler/install/gemfile/gemspec_spec.rb
@@ -422,13 +422,14 @@ RSpec.describe "bundle install from an existing gemspec" do
           end
         end
 
-        gemfile <<-G
-          source "#{file_uri_for(gem_repo2)}"
-          gemspec
-        G
-
-        simulate_platform("ruby") { bundle "install" }
-        simulate_platform("jruby") { bundle "install" }
+        %w[ruby jruby].each do |platform|
+          simulate_platform(platform) do
+            install_gemfile <<-G
+              source "#{file_uri_for(gem_repo2)}"
+              gemspec
+            G
+          end
+        end
       end
 
       context "on ruby" do
diff --git a/spec/bundler/install/gemfile/sources_spec.rb b/spec/bundler/install/gemfile/sources_spec.rb
index e40ae84c59..655f91dd69 100644
--- a/spec/bundler/install/gemfile/sources_spec.rb
+++ b/spec/bundler/install/gemfile/sources_spec.rb
@@ -27,7 +27,7 @@ RSpec.describe "bundle install with gems on multiple sources" do
         G
       end
 
-      it "warns about ambiguous gems, but installs anyway, prioritizing sources last to first", :bundler => "< 3" do
+      it "warns about ambiguous gems, but installs anyway, prioritizing sources last to first", :bundler => "2" do
         bundle :install
 
         expect(err).to include("Warning: the gem 'rack' was found in multiple sources.")
@@ -54,7 +54,7 @@ RSpec.describe "bundle install with gems on multiple sources" do
         G
       end
 
-      it "warns about ambiguous gems, but installs anyway", :bundler => "< 3" do
+      it "warns about ambiguous gems, but installs anyway", :bundler => "2" do
         bundle :install
         expect(err).to include("Warning: the gem 'rack' was found in multiple sources.")
         expect(err).to include("Installed from: #{file_uri_for(gem_repo1)}")
@@ -96,7 +96,7 @@ RSpec.describe "bundle install with gems on multiple sources" do
 
       it "installs the gems without any warning" do
         bundle :install
-        expect(err).not_to include("Warning")
+        expect(out).not_to include("Warning")
         expect(the_bundle).to include_gems("rack-obama 1.0.0")
         expect(the_bundle).to include_gems("rack 1.0.0", :source => "remote1")
       end
@@ -128,7 +128,7 @@ RSpec.describe "bundle install with gems on multiple sources" do
           end
         end
 
-        install_gemfile <<-G
+        gemfile <<-G
           source "#{file_uri_for(gem_repo3)}"
           gem "rack-obama" # should come from repo3!
           gem "rack", :source => "#{file_uri_for(gem_repo1)}"
@@ -136,7 +136,8 @@ RSpec.describe "bundle install with gems on multiple sources" do
       end
 
       it "installs the gems without any warning" do
-        expect(err).not_to include("Warning")
+        bundle :install
+        expect(out).not_to include("Warning")
         expect(the_bundle).to include_gems("rack-obama 1.0.0", "rack 1.0.0")
       end
     end
@@ -172,8 +173,8 @@ RSpec.describe "bundle install with gems on multiple sources" do
 
           it "installs from the same source without any warning" do
             bundle :install
-            expect(err).not_to include("Warning")
-            expect(the_bundle).to include_gems("depends_on_rack 1.0.1", "rack 1.0.0", :source => "remote3")
+            expect(out).not_to include("Warning")
+            expect(the_bundle).to include_gems("depends_on_rack 1.0.1", "rack 1.0.0")
           end
         end
 
@@ -187,38 +188,27 @@ RSpec.describe "bundle install with gems on multiple sources" do
             end
           end
 
-          it "installs from the same source without any warning" do
-            bundle :install
+          context "when disable_multisource is set" do
+            before do
+              bundle "config set disable_multisource true"
+            end
 
-            expect(err).not_to include("Warning: the gem 'rack' was found in multiple sources.")
-            expect(the_bundle).to include_gems("depends_on_rack 1.0.1", "rack 1.0.0", :source => "remote3")
+            it "installs from the same source without any warning" do
+              bundle :install
 
-            # In https://github.com/bundler/bundler/issues/3585 this failed
-            # when there is already a lock file, and the gems are missing, so try again
-            system_gems []
-            bundle :install
+              expect(out).not_to include("Warning: the gem 'rack' was found in multiple sources.")
+              expect(err).not_to include("Warning: the gem 'rack' was found in multiple sources.")
+              expect(the_bundle).to include_gems("depends_on_rack 1.0.1", "rack 1.0.0")
 
-            expect(err).not_to include("Warning: the gem 'rack' was found in multiple sources.")
-            expect(the_bundle).to include_gems("depends_on_rack 1.0.1", "rack 1.0.0", :source => "remote3")
-          end
-        end
+              # when there is already a lock file, and the gems are missing, so try again
+              system_gems []
+              bundle :install
 
-        context "and in another source with a higher version" do
-          before do
-            # need this to be broken to check for correct source ordering
-            build_repo gem_repo2 do
-              build_gem "rack", "1.0.1" do |s|
-                s.write "lib/rack.rb", "RACK = 'FAIL'"
-              end
+              expect(out).not_to include("Warning: the gem 'rack' was found in multiple sources.")
+              expect(err).not_to include("Warning: the gem 'rack' was found in multiple sources.")
+              expect(the_bundle).to include_gems("depends_on_rack 1.0.1", "rack 1.0.0")
             end
           end
-
-          it "installs from the same source without any warning" do
-            bundle :install
-
-            expect(err).not_to include("Warning: the gem 'rack' was found in multiple sources.")
-            expect(the_bundle).to include_gems("depends_on_rack 1.0.1", "rack 1.0.0", :source => "remote3")
-          end
         end
       end
 
@@ -232,7 +222,7 @@ RSpec.describe "bundle install with gems on multiple sources" do
 
         context "and not in any other sources" do
           before do
-            install_gemfile <<-G
+            gemfile <<-G
               source "#{file_uri_for(gem_repo2)}"
               source "#{file_uri_for(gem_repo3)}" do
                 gem "depends_on_rack"
@@ -241,7 +231,8 @@ RSpec.describe "bundle install with gems on multiple sources" do
           end
 
           it "installs from the other source without any warning" do
-            expect(err).not_to include("Warning")
+            bundle :install
+            expect(out).not_to include("Warning")
             expect(the_bundle).to include_gems("depends_on_rack 1.0.1", "rack 1.0.0")
           end
         end
@@ -257,7 +248,7 @@ RSpec.describe "bundle install with gems on multiple sources" do
             G
           end
 
-          it "installs from the other source and warns about ambiguous gems", :bundler => "< 3" do
+          it "installs from the other source and warns about ambiguous gems", :bundler => "2" do
             bundle :install
             expect(err).to include("Warning: the gem 'rack' was found in multiple sources.")
             expect(err).to include("Installed from: #{file_uri_for(gem_repo2)}")
@@ -289,7 +280,7 @@ RSpec.describe "bundle install with gems on multiple sources" do
             G
           end
 
-          it "installs the dependency from the pinned source without warning", :bundler => "< 3" do
+          it "installs the dependency from the pinned source without warning", :bundler => "2" do
             bundle :install
 
             expect(err).not_to include("Warning: the gem 'rack' was found in multiple sources.")
@@ -314,74 +305,80 @@ RSpec.describe "bundle install with gems on multiple sources" do
     end
 
     context "when a top-level gem has an indirect dependency" do
-      before do
-        build_repo gem_repo2 do
-          build_gem "depends_on_rack", "1.0.1" do |s|
-            s.add_dependency "rack"
-          end
+      context "when disable_multisource is set" do
+        before do
+          bundle "config set disable_multisource true"
         end
 
-        build_repo gem_repo3 do
-          build_gem "unrelated_gem", "1.0.0"
-        end
+        before do
+          build_repo gem_repo2 do
+            build_gem "depends_on_rack", "1.0.1" do |s|
+              s.add_dependency "rack"
+            end
+          end
 
-        gemfile <<-G
-          source "#{file_uri_for(gem_repo2)}"
+          build_repo gem_repo3 do
+            build_gem "unrelated_gem", "1.0.0"
+          end
 
-          gem "depends_on_rack"
+          gemfile <<-G
+            source "#{file_uri_for(gem_repo2)}"
 
-          source "#{file_uri_for(gem_repo3)}" do
-            gem "unrelated_gem"
-          end
-        G
-      end
+            gem "depends_on_rack"
 
-      context "and the dependency is only in the top-level source" do
-        before do
-          update_repo gem_repo2 do
-            build_gem "rack", "1.0.0"
-          end
+            source "#{file_uri_for(gem_repo3)}" do
+              gem "unrelated_gem"
+            end
+          G
         end
 
-        it "installs all gems without warning" do
-          bundle :install
-          expect(err).not_to include("Warning")
-          expect(the_bundle).to include_gems("depends_on_rack 1.0.1", "rack 1.0.0", "unrelated_gem 1.0.0")
+        context "and the dependency is only in the top-level source" do
+          before do
+            update_repo gem_repo2 do
+              build_gem "rack", "1.0.0"
+            end
+          end
+
+          it "installs all gems without warning" do
+            bundle :install
+            expect(err).not_to include("Warning")
+            expect(the_bundle).to include_gems("depends_on_rack 1.0.1", "rack 1.0.0", "unrelated_gem 1.0.0")
+          end
         end
-      end
 
-      context "and the dependency is only in a pinned source" do
-        before do
-          update_repo gem_repo3 do
-            build_gem "rack", "1.0.0" do |s|
-              s.write "lib/rack.rb", "RACK = 'FAIL'"
+        context "and the dependency is only in a pinned source" do
+          before do
+            update_repo gem_repo3 do
+              build_gem "rack", "1.0.0" do |s|
+                s.write "lib/rack.rb", "RACK = 'FAIL'"
+              end
             end
           end
-        end
 
-        it "does not find the dependency" do
-          bundle :install, :raise_on_error => false
-          expect(err).to include("Could not find gem 'rack', which is required by gem 'depends_on_rack', in any of the relevant sources")
+          it "does not find the dependency" do
+            bundle :install, :raise_on_error => false
+            expect(err).to include("Could not find gem 'rack', which is required by gem 'depends_on_rack', in any of the relevant sources")
+          end
         end
-      end
 
-      context "and the dependency is in both the top-level and a pinned source" do
-        before do
-          update_repo gem_repo2 do
-            build_gem "rack", "1.0.0"
-          end
+        context "and the dependency is in both the top-level and a pinned source" do
+          before do
+            update_repo gem_repo2 do
+              build_gem "rack", "1.0.0"
+            end
 
-          update_repo gem_repo3 do
-            build_gem "rack", "1.0.0" do |s|
-              s.write "lib/rack.rb", "RACK = 'FAIL'"
+            update_repo gem_repo3 do
+              build_gem "rack", "1.0.0" do |s|
+                s.write "lib/rack.rb", "RACK = 'FAIL'"
+              end
             end
           end
-        end
 
-        it "installs the dependency from the top-level source without warning" do
-          bundle :install
-          expect(err).not_to include("Warning")
-          expect(the_bundle).to include_gems("depends_on_rack 1.0.1", "rack 1.0.0", "unrelated_gem 1.0.0")
+          it "installs the dependency from the top-level source without warning" do
+            bundle :install
+            expect(err).not_to include("Warning")
+            expect(the_bundle).to include_gems("depends_on_rack 1.0.1", "rack 1.0.0", "unrelated_gem 1.0.0")
+          end
         end
       end
     end
@@ -392,14 +389,15 @@ RSpec.describe "bundle install with gems on multiple sources" do
           build_gem "not_in_repo1", "1.0.0"
         end
 
-        install_gemfile <<-G, :raise_on_error => false
+        gemfile <<-G
           source "#{file_uri_for(gem_repo3)}"
           gem "not_in_repo1", :source => "#{file_uri_for(gem_repo1)}"
         G
       end
 
       it "does not install the gem" do
-        expect(err).to include("Could not find gem 'not_in_repo1")
+        bundle :install, :raise_on_error => false
+        expect(err).to include("Could not find gem 'not_in_repo1'")
       end
     end
 
@@ -435,92 +433,6 @@ RSpec.describe "bundle install with gems on multiple sources" do
       end
     end
 
-    context "with a lockfile with aggregated rubygems sources" do
-      let(:aggregate_gem_section_lockfile) do
-        <<~L
-          GEM
-            remote: #{file_uri_for(gem_repo1)}/
-            remote: #{file_uri_for(gem_repo3)}/
-            specs:
-              rack (0.9.1)
-
-          PLATFORMS
-            #{specific_local_platform}
-
-          DEPENDENCIES
-            rack!
-
-          BUNDLED WITH
-             #{Bundler::VERSION}
-        L
-      end
-
-      let(:split_gem_section_lockfile) do
-        <<~L
-          GEM
-            remote: #{file_uri_for(gem_repo1)}/
-            specs:
-
-          GEM
-            remote: #{file_uri_for(gem_repo3)}/
-            specs:
-              rack (0.9.1)
-
-          PLATFORMS
-            #{specific_local_platform}
-
-          DEPENDENCIES
-            rack!
-
-          BUNDLED WITH
-             #{Bundler::VERSION}
-        L
-      end
-
-      before do
-        build_repo gem_repo3 do
-          build_gem "rack", "0.9.1"
-        end
-
-        gemfile <<-G
-          source "#{file_uri_for(gem_repo1)}"
-          source "#{file_uri_for(gem_repo3)}" do
-            gem 'rack'
-          end
-        G
-
-        lockfile aggregate_gem_section_lockfile
-      end
-
-      it "installs a lockfile with separate rubygems source sections if not in frozen mode" do
-        bundle "install"
-
-        expect(lockfile).to eq(split_gem_section_lockfile)
-
-        expect(the_bundle).to include_gems("rack 0.9.1", :source => "remote3")
-      end
-
-      it "installs the existing lockfile but prints a warning if in frozen mode", :bundler => "< 3" do
-        bundle "config set --local deployment true"
-
-        bundle "install"
-
-        expect(lockfile).to eq(aggregate_gem_section_lockfile)
-
-        expect(the_bundle).to include_gems("rack 0.9.1", :source => "remote3")
-      end
-
-      it "refuses to install the existing lockfile and prints an error if in frozen mode", :bundler => "3" do
-        bundle "config set --local deployment true"
-
-        bundle "install", :raise_on_error =>false
-
-        expect(lockfile).to eq(aggregate_gem_section_lockfile)
-        expect(err).to include("Your lockfile contains a single rubygems source section with multiple remotes, which is insecure.")
-        expect(out).to be_empty
-      end
-    end
-
     context "with a path gem in the same Gemfile" do
       before do
         build_lib "foo"
@@ -545,13 +457,14 @@ RSpec.describe "bundle install with gems on multiple sources" do
     before do
       system_gems "rack-0.9.1"
 
-      install_gemfile <<-G
+      gemfile <<-G
         source "#{file_uri_for(gem_repo1)}"
         gem "rack" # shoud come from repo1!
       G
     end
 
     it "installs the gems without any warning" do
+      bundle :install
       expect(err).not_to include("Warning")
       expect(the_bundle).to include_gems("rack 1.0.0")
     end
@@ -702,12 +615,16 @@ RSpec.describe "bundle install with gems on multiple sources" do
       G
     end
 
-    it "installs the higher version in the new repo" do
+    it "keeps the old version", :bundler => "2" do
+      expect(the_bundle).to include_gems("rack 1.0.0")
+    end
+
+    it "installs the higher version in the new repo", :bundler => "3" do
       expect(the_bundle).to include_gems("rack 1.2")
     end
   end
 
-  context "when a gem is available from multiple ambiguous sources" do
+  context "when a gem is available from multiple ambiguous sources", :bundler => "3" do
     it "raises, suggesting a source block" do
       build_repo4 do
         build_gem "depends_on_rack" do |s|