Merge RubyGems-3.3.24 and Bundler-2.3.24

13 files changed, 118 insertions, 67 deletions

diff --git a/spec/bundler/bundler/definition_spec.rb b/spec/bundler/bundler/definition_spec.rb
index 13688c2b3d..e7235a4e78 100644
--- a/spec/bundler/bundler/definition_spec.rb
+++ b/spec/bundler/bundler/definition_spec.rb
@@ -82,6 +82,24 @@ RSpec.describe Bundler::Definition do
       G
     end
 
+    it "with an explicit update" do
+      build_repo4 do
+        build_gem("ffi", "1.9.23") {|s| s.platform = "java" }
+        build_gem("ffi", "1.9.23")
+      end
+
+      gemfile <<-G
+        source "#{file_uri_for(gem_repo4)}"
+        gem "ffi"
+      G
+
+      bundle "lock --add-platform java"
+
+      bundle "update ffi", :env => { "DEBUG" => "1" }
+
+      expect(out).to match(/because bundler is unlocking gems: \(ffi\)/)
+    end
+
     it "for a path gem with deps and no changes" do
       build_lib "foo", "1.0", :path => lib_path("foo") do |s|
         s.add_dependency "rack", "1.0"
diff --git a/spec/bundler/bundler/dep_proxy_spec.rb b/spec/bundler/bundler/dep_proxy_spec.rb
deleted file mode 100644
index 8d02a33725..0000000000
--- a/spec/bundler/bundler/dep_proxy_spec.rb
+++ /dev/null
@@ -1,32 +0,0 @@
-# frozen_string_literal: true
-
-RSpec.describe Bundler::DepProxy do
-  let(:dep) { Bundler::Dependency.new("rake", ">= 0") }
-  subject { described_class.get_proxy(dep, Gem::Platform::RUBY) }
-  let(:same) { subject }
-  let(:other) { described_class.get_proxy(dep, Gem::Platform::RUBY) }
-  let(:different) { described_class.get_proxy(dep, Gem::Platform::JAVA) }
-
-  describe "#eql?" do
-    it { expect(subject.eql?(same)).to be true }
-    it { expect(subject.eql?(other)).to be true }
-    it { expect(subject.eql?(different)).to be false }
-    it { expect(subject.eql?(nil)).to be false }
-    it { expect(subject.eql?("foobar")).to be false }
-  end
-
-  describe "must use factory methods" do
-    it { expect { described_class.new(dep, Gem::Platform::RUBY) }.to raise_error NoMethodError }
-    it { expect { subject.dup }.to raise_error NoMethodError }
-    it { expect { subject.clone }.to raise_error NoMethodError }
-  end
-
-  describe "frozen" do
-    if Gem.ruby_version >= Gem::Version.new("2.5.0")
-      error = Object.const_get("FrozenError")
-    else
-      error = RuntimeError
-    end
-    it { expect { subject.instance_variable_set(:@__platform, {}) }.to raise_error error }
-  end
-end
diff --git a/spec/bundler/bundler/gem_version_promoter_spec.rb b/spec/bundler/bundler/gem_version_promoter_spec.rb
index 99e008bfbc..54c559c1d8 100644
--- a/spec/bundler/bundler/gem_version_promoter_spec.rb
+++ b/spec/bundler/bundler/gem_version_promoter_spec.rb
@@ -28,7 +28,7 @@ RSpec.describe Bundler::GemVersionPromoter do
 
     def build_spec_groups(name, versions)
       versions.map do |v|
-        Bundler::Resolver::SpecGroup.create_for({ Gem::Platform::RUBY => build_spec(name, v) }, [Gem::Platform::RUBY], Gem::Platform::RUBY)
+        Bundler::Resolver::SpecGroup.new(build_spec(name, v), [Gem::Platform::RUBY])
       end
     end
 
diff --git a/spec/bundler/bundler/remote_specification_spec.rb b/spec/bundler/bundler/remote_specification_spec.rb
index 8115e026d8..921a47a2d3 100644
--- a/spec/bundler/bundler/remote_specification_spec.rb
+++ b/spec/bundler/bundler/remote_specification_spec.rb
@@ -45,7 +45,7 @@ RSpec.describe Bundler::RemoteSpecification do
       let(:platform) { "jruby" }
 
       it "should return the spec name, version, and platform" do
-        expect(subject.full_name).to eq("foo-1.0.0-jruby")
+        expect(subject.full_name).to eq("foo-1.0.0-java")
       end
     end
   end
diff --git a/spec/bundler/cache/git_spec.rb b/spec/bundler/cache/git_spec.rb
index fed8ba43f4..7ea23cd312 100644
--- a/spec/bundler/cache/git_spec.rb
+++ b/spec/bundler/cache/git_spec.rb
@@ -156,9 +156,6 @@ RSpec.describe "bundle cache with git" do
   end
 
   it "copies repository to vendor cache, including submodules" do
-    # CVE-2022-39253: https://lore.kernel.org/lkml/xmqq4jw1uku5.fsf@gitster.g/
-    system(*%W[git config --global protocol.file.allow always])
-
     build_git "submodule", "1.0"
 
     git = build_git "has_submodule", "1.0" do |s|
diff --git a/spec/bundler/install/gemfile/git_spec.rb b/spec/bundler/install/gemfile/git_spec.rb
index fb99c99b2d..2058674105 100644
--- a/spec/bundler/install/gemfile/git_spec.rb
+++ b/spec/bundler/install/gemfile/git_spec.rb
@@ -865,9 +865,6 @@ RSpec.describe "bundle install with git sources" do
   end
 
   it "ignores submodules if :submodule is not passed" do
-    # CVE-2022-39253: https://lore.kernel.org/lkml/xmqq4jw1uku5.fsf@gitster.g/
-    system(*%W[git config --global protocol.file.allow always])
-
     build_git "submodule", "1.0"
     build_git "has_submodule", "1.0" do |s|
       s.add_dependency "submodule"
@@ -887,9 +884,6 @@ RSpec.describe "bundle install with git sources" do
   end
 
   it "handles repos with submodules" do
-    # CVE-2022-39253: https://lore.kernel.org/lkml/xmqq4jw1uku5.fsf@gitster.g/
-    system(*%W[git config --global protocol.file.allow always])
-
     build_git "submodule", "1.0"
     build_git "has_submodule", "1.0" do |s|
       s.add_dependency "submodule"
@@ -908,9 +902,6 @@ RSpec.describe "bundle install with git sources" do
   end
 
   it "does not warn when deiniting submodules" do
-    # CVE-2022-39253: https://lore.kernel.org/lkml/xmqq4jw1uku5.fsf@gitster.g/
-    system(*%W[git config --global protocol.file.allow always])
-
     build_git "submodule", "1.0"
     build_git "has_submodule", "1.0"
 
diff --git a/spec/bundler/install/gems/resolving_spec.rb b/spec/bundler/install/gems/resolving_spec.rb
index 9f4da23162..7a5307720f 100644
--- a/spec/bundler/install/gems/resolving_spec.rb
+++ b/spec/bundler/install/gems/resolving_spec.rb
@@ -187,7 +187,7 @@ RSpec.describe "bundle install with install-time dependencies" do
 
         bundle :install, :env => { "DEBUG_RESOLVER_TREE" => "1", "DEBUG" => "1" }
 
-        activated_groups = "net_b (1.0) (ruby), net_b (1.0) (#{specific_local_platform})"
+        activated_groups = "net_b (1.0) (ruby)"
 
         expect(out).to include(" net_b").
           and include("BUNDLER: Starting resolution").
@@ -305,7 +305,7 @@ RSpec.describe "bundle install with install-time dependencies" do
         end
       end
 
-      context "in a transitive dependencies in a lockfile" do
+      context "with transitive dependencies in a lockfile" do
         before do
           build_repo2 do
             build_gem "rubocop", "1.28.2" do |s|
diff --git a/spec/bundler/install/yanked_spec.rb b/spec/bundler/install/yanked_spec.rb
index 09a5ba0be1..78b701e488 100644
--- a/spec/bundler/install/yanked_spec.rb
+++ b/spec/bundler/install/yanked_spec.rb
@@ -30,6 +30,72 @@ RSpec.context "when installing a bundle that includes yanked gems" do
     expect(err).to include("Your bundle is locked to foo (10.0.0)")
   end
 
+  context "when a re-resolve is necessary, and a yanked version is considered by the resolver" do
+    before do
+      skip "Materialization on Windows is not yet strict, so the example does not detect the gem has been yanked" if Gem.win_platform?
+
+      build_repo4 do
+        build_gem "foo", "1.0.0", "1.0.1"
+        build_gem "actiontext", "6.1.7" do |s|
+          s.add_dependency "nokogiri", ">= 1.8"
+        end
+        build_gem "actiontext", "6.1.6" do |s|
+          s.add_dependency "nokogiri", ">= 1.8"
+        end
+        build_gem "actiontext", "6.1.7" do |s|
+          s.add_dependency "nokogiri", ">= 1.8"
+        end
+        build_gem "nokogiri", "1.13.8"
+      end
+
+      gemfile <<~G
+        source "#{source_uri}"
+        gem "foo", "1.0.1"
+        gem "actiontext", "6.1.6"
+      G
+
+      lockfile <<~L
+        GEM
+          remote: #{source_uri}/
+          specs:
+            actiontext (6.1.6)
+              nokogiri (>= 1.8)
+            foo (1.0.0)
+            nokogiri (1.13.8-#{Bundler.local_platform})
+
+        PLATFORMS
+          #{lockfile_platforms}
+
+        DEPENDENCIES
+          actiontext (= 6.1.6)
+          foo (= 1.0.0)
+
+        BUNDLED WITH
+           #{Bundler::VERSION}
+      L
+    end
+
+    context "and the old index is used" do
+      let(:source_uri) { file_uri_for(gem_repo4) }
+
+      it "reports the yanked gem properly" do
+        bundle "install", :raise_on_error => false
+
+        expect(err).to include("Your bundle is locked to nokogiri (1.13.8-#{Bundler.local_platform})")
+      end
+    end
+
+    context "and the compact index API is used" do
+      let(:source_uri) { "https://gem.repo4" }
+
+      it "reports the yanked gem properly" do
+        bundle "install", :artifice => "compact_index", :raise_on_error => false
+
+        expect(err).to include("Your bundle is locked to nokogiri (1.13.8-#{Bundler.local_platform})")
+      end
+    end
+  end
+
   it "throws the original error when only the Gemfile specifies a gem version that doesn't exist" do
     bundle "config set force_ruby_platform true"
 
diff --git a/spec/bundler/realworld/slow_perf_spec.rb b/spec/bundler/realworld/slow_perf_spec.rb
index 9f11821bf5..3ef537be0a 100644
--- a/spec/bundler/realworld/slow_perf_spec.rb
+++ b/spec/bundler/realworld/slow_perf_spec.rb
@@ -11,12 +11,23 @@ RSpec.describe "bundle install with complex dependencies", :realworld => true do
       gem "mongoid", ">= 0.10.2"
     G
 
-    start_time = Time.now
+    expect { bundle "lock" }.to take_less_than(18) # seconds
+  end
+
+  it "resolves quickly (case 2)" do
+    gemfile <<-G
+      source "https://rubygems.org"
 
-    bundle "lock"
+      gem 'metasploit-erd'
+      gem 'rails-erd'
+      gem 'yard'
 
-    duration = Time.now - start_time
+      gem 'coveralls'
+      gem 'rails'
+      gem 'simplecov'
+      gem 'rspec-rails'
+    G
 
-    expect(duration.to_f).to be < 18 # seconds
+    expect { bundle "lock" }.to take_less_than(18) # seconds
   end
 end
diff --git a/spec/bundler/resolver/basic_spec.rb b/spec/bundler/resolver/basic_spec.rb
index ee62dc3577..b583fb8715 100644
--- a/spec/bundler/resolver/basic_spec.rb
+++ b/spec/bundler/resolver/basic_spec.rb
@@ -174,12 +174,7 @@ Bundler could not find compatible versions for gem "a":
     dep "foo"
     dep "Ruby\0", "1.8.7"
 
-    deps = []
-    @deps.each do |d|
-      deps << Bundler::DepProxy.get_proxy(d, "ruby")
-    end
-
-    should_resolve_and_include %w[foo-1.0.0 bar-1.0.0], [[]]
+    should_resolve_and_include %w[foo-1.0.0 bar-1.0.0]
   end
 
   context "conservative" do
diff --git a/spec/bundler/support/indexes.rb b/spec/bundler/support/indexes.rb
index c496679ee6..e20059429c 100644
--- a/spec/bundler/support/indexes.rb
+++ b/spec/bundler/support/indexes.rb
@@ -16,21 +16,17 @@ module Spec
 
     def resolve(args = [])
       @platforms ||= ["ruby"]
-      deps = []
       default_source = instance_double("Bundler::Source::Rubygems", :specs => @index, :to_s => "locally install gems")
       source_requirements = { :default => default_source }
       @deps.each do |d|
         source_requirements[d.name] = d.source = default_source
-        @platforms.each do |p|
-          deps << Bundler::DepProxy.get_proxy(d, p)
-        end
       end
-      args[0] ||= [] # base
+      args[0] ||= Bundler::SpecSet.new([]) # base
       args[0].each {|ls| ls.source = default_source }
       args[1] ||= Bundler::GemVersionPromoter.new # gem_version_promoter
       args[2] ||= [] # additional_base_requirements
       args[3] ||= @platforms # platforms
-      Bundler::Resolver.resolve(deps, source_requirements, *args)
+      Bundler::Resolver.new(source_requirements, *args).start(@deps)
     end
 
     def should_not_resolve
diff --git a/spec/bundler/support/matchers.rb b/spec/bundler/support/matchers.rb
index ce6b216619..8b22e7dbc3 100644
--- a/spec/bundler/support/matchers.rb
+++ b/spec/bundler/support/matchers.rb
@@ -97,6 +97,18 @@ module Spec
       end
     end
 
+    RSpec::Matchers.define :take_less_than do |seconds|
+      match do |actual|
+        start_time = Time.now
+
+        actual.call
+
+        (Time.now - start_time).to_f < seconds
+      end
+
+      supports_block_expectations
+    end
+
     define_compound_matcher :read_as, [exist] do |file_contents|
       diffable
 
diff --git a/spec/bundler/update/git_spec.rb b/spec/bundler/update/git_spec.rb
index 427a0bb713..da92cab1cc 100644
--- a/spec/bundler/update/git_spec.rb
+++ b/spec/bundler/update/git_spec.rb
@@ -124,9 +124,6 @@ RSpec.describe "bundle update" do
 
     describe "with submodules" do
       before :each do
-        # CVE-2022-39253: https://lore.kernel.org/lkml/xmqq4jw1uku5.fsf@gitster.g/
-        system(*%W[git config --global protocol.file.allow always])
-
         build_repo4 do
           build_gem "submodule" do |s|
             s.write "lib/submodule.rb", "puts 'GEM'"