Merge RubyGems-3.5.18 and Bundler-2.5.18

15 files changed, 271 insertions, 24 deletions

diff --git a/spec/bundler/bundler/bundler_spec.rb b/spec/bundler/bundler/bundler_spec.rb
index 2c8453da4d..7cfc12a6f6 100644
--- a/spec/bundler/bundler/bundler_spec.rb
+++ b/spec/bundler/bundler/bundler_spec.rb
@@ -267,6 +267,7 @@ RSpec.describe Bundler do
         it "should issue a warning and return a temporary user home" do
           allow(Bundler.rubygems).to receive(:user_home).and_return(path)
           allow(File).to receive(:directory?).with(path).and_return true
+          allow(File).to receive(:writable?).and_call_original
           allow(File).to receive(:writable?).with(path).and_return false
           allow(File).to receive(:directory?).with(dotbundle).and_return false
           allow(Bundler).to receive(:tmp).and_return(Pathname.new("/tmp/trulyrandom"))
diff --git a/spec/bundler/cache/git_spec.rb b/spec/bundler/cache/git_spec.rb
index 4e3038f3ce..cbd755872c 100644
--- a/spec/bundler/cache/git_spec.rb
+++ b/spec/bundler/cache/git_spec.rb
@@ -258,6 +258,46 @@ RSpec.describe "bundle cache with git" do
     end
   end
 
+  it "can install after bundle cache generated with an older Bundler that kept checkouts in the cache" do
+    git = build_git("foo")
+    locked_revision = git.ref_for("main")
+    path_revision = git.ref_for("main", 11)
+
+    git_path = lib_path("foo-1.0")
+
+    gemfile <<-G
+      source "https://gem.repo1"
+      gem "foo", :git => '#{git_path}'
+    G
+    lockfile <<~L
+      GIT
+        remote: #{git_path}/
+        revision: #{locked_revision}
+        specs:
+          foo (1.0)
+
+      GEM
+        remote: https://gem.repo1/
+        specs:
+
+      PLATFORMS
+        #{lockfile_platforms}
+
+      DEPENDENCIES
+        foo!
+
+      BUNDLED WITH
+         #{Bundler::VERSION}
+    L
+
+    # Simulate an old incorrect situation where vendor/cache would be the install location of git gems
+    FileUtils.mkdir_p bundled_app("vendor/cache")
+    FileUtils.cp_r git_path, bundled_app("vendor/cache/foo-1.0-#{path_revision}")
+    FileUtils.rm_rf bundled_app("vendor/cache/foo-1.0-#{path_revision}/.git")
+
+    bundle :install, env: { "BUNDLE_DEPLOYMENT" => "true", "BUNDLE_CACHE_ALL" => "true" }
+  end
+
   it "respects the --no-install flag" do
     git = build_git "foo", &:add_c_extension
     ref = git.ref_for("main", 11)
diff --git a/spec/bundler/commands/install_spec.rb b/spec/bundler/commands/install_spec.rb
index 09f920052a..c89ed0c870 100644
--- a/spec/bundler/commands/install_spec.rb
+++ b/spec/bundler/commands/install_spec.rb
@@ -1362,12 +1362,20 @@ RSpec.describe "bundle install with gem sources" do
         build_gem "foo", "1.0.1"
         build_gem "foo", "1.0.0"
         build_gem "bar", "1.0.0"
+
+        build_gem "a", "1.0.0" do |s|
+          s.add_dependency "foo", "~> 1.0.0"
+        end
+
+        build_gem "b", "1.0.0" do |s|
+          s.add_dependency "foo", "~> 1.0.1"
+        end
       end
 
       system_gems "foo-1.0.0", path: default_bundle_path, gem_repo: gem_repo4
     end
 
-    it "fetches remote sources only when not available locally" do
+    it "fetches remote sources when not available locally" do
       install_gemfile <<-G, "prefer-local": true, verbose: true
         source "https://gem.repo4"
 
@@ -1378,6 +1386,40 @@ RSpec.describe "bundle install with gem sources" do
       expect(out).to include("Using foo 1.0.0").and include("Fetching bar 1.0.0").and include("Installing bar 1.0.0")
       expect(last_command).to be_success
     end
+
+    it "fetches remote sources when local version does not match requirements" do
+      install_gemfile <<-G, "prefer-local": true, verbose: true
+        source "https://gem.repo4"
+
+        gem "foo", "1.0.1"
+        gem "bar"
+      G
+
+      expect(out).to include("Fetching foo 1.0.1").and include("Installing foo 1.0.1").and include("Fetching bar 1.0.0").and include("Installing bar 1.0.0")
+      expect(last_command).to be_success
+    end
+
+    it "uses the locally available version for sub-dependencies when possible" do
+      install_gemfile <<-G, "prefer-local": true, verbose: true
+        source "https://gem.repo4"
+
+        gem "a"
+      G
+
+      expect(out).to include("Using foo 1.0.0").and include("Fetching a 1.0.0").and include("Installing a 1.0.0")
+      expect(last_command).to be_success
+    end
+
+    it "fetches remote sources for sub-dependencies when the locally available version does not satisfy the requirement" do
+      install_gemfile <<-G, "prefer-local": true, verbose: true
+        source "https://gem.repo4"
+
+        gem "b"
+      G
+
+      expect(out).to include("Fetching foo 1.0.1").and include("Installing foo 1.0.1").and include("Fetching b 1.0.0").and include("Installing b 1.0.0")
+      expect(last_command).to be_success
+    end
   end
 
   context "with a symlinked configured as bundle path and a gem with symlinks" do
diff --git a/spec/bundler/commands/lock_spec.rb b/spec/bundler/commands/lock_spec.rb
index 2502eae33e..6d005cfc96 100644
--- a/spec/bundler/commands/lock_spec.rb
+++ b/spec/bundler/commands/lock_spec.rb
@@ -1990,4 +1990,64 @@ RSpec.describe "bundle lock" do
       L
     end
   end
+
+  context "when lockfile has incorrectly indented platforms" do
+    before do
+      build_repo4 do
+        build_gem "ffi", "1.1.0" do |s|
+          s.platform = "x86_64-linux"
+        end
+
+        build_gem "ffi", "1.1.0" do |s|
+          s.platform = "arm64-darwin"
+        end
+      end
+
+      gemfile <<~G
+        source "https://gem.repo4"
+
+        gem "ffi"
+      G
+
+      lockfile <<~L
+        GEM
+          remote: https://gem.repo4/
+          specs:
+            ffi (1.1.0-arm64-darwin)
+
+        PLATFORMS
+           arm64-darwin
+
+        DEPENDENCIES
+          ffi
+
+        BUNDLED WITH
+           #{Bundler::VERSION}
+      L
+    end
+
+    it "does not remove any gems" do
+      simulate_platform "x86_64-linux" do
+        bundle "lock --update"
+      end
+
+      expect(lockfile).to eq <<~L
+        GEM
+          remote: https://gem.repo4/
+          specs:
+            ffi (1.1.0-arm64-darwin)
+            ffi (1.1.0-x86_64-linux)
+
+        PLATFORMS
+          arm64-darwin
+          x86_64-linux
+
+        DEPENDENCIES
+          ffi
+
+        BUNDLED WITH
+           #{Bundler::VERSION}
+      L
+    end
+  end
 end
diff --git a/spec/bundler/commands/outdated_spec.rb b/spec/bundler/commands/outdated_spec.rb
index c5663acfb8..55706df0d6 100644
--- a/spec/bundler/commands/outdated_spec.rb
+++ b/spec/bundler/commands/outdated_spec.rb
@@ -162,7 +162,7 @@ RSpec.describe "bundle outdated" do
         build_gem "vcr", "6.0.0"
       end
 
-      build_repo gem_repo3 do
+      build_repo3 do
         build_gem "pkg-gem-flowbyte-with-dep", "1.0.0" do |s|
           s.add_dependency "oj"
         end
diff --git a/spec/bundler/commands/remove_spec.rb b/spec/bundler/commands/remove_spec.rb
index d2d7d1b6a8..7ac2ea9b26 100644
--- a/spec/bundler/commands/remove_spec.rb
+++ b/spec/bundler/commands/remove_spec.rb
@@ -409,7 +409,7 @@ RSpec.describe "bundle remove" do
 
   context "with sources" do
     before do
-      build_repo gem_repo3 do
+      build_repo3 do
         build_gem "rspec"
       end
     end
diff --git a/spec/bundler/commands/update_spec.rb b/spec/bundler/commands/update_spec.rb
index feea554d22..3760d49d7f 100644
--- a/spec/bundler/commands/update_spec.rb
+++ b/spec/bundler/commands/update_spec.rb
@@ -956,7 +956,7 @@ RSpec.describe "bundle update" do
         build_gem "vcr", "6.0.0"
       end
 
-      build_repo gem_repo3 do
+      build_repo3 do
         build_gem "pkg-gem-flowbyte-with-dep", "1.0.0" do |s|
           s.add_dependency "oj"
         end
diff --git a/spec/bundler/install/allow_offline_install_spec.rb b/spec/bundler/install/allow_offline_install_spec.rb
index 2d313531e0..21b0568f7d 100644
--- a/spec/bundler/install/allow_offline_install_spec.rb
+++ b/spec/bundler/install/allow_offline_install_spec.rb
@@ -53,10 +53,10 @@ RSpec.describe "bundle install with :allow_offline_install" do
       File.open(tmp("broken_path/git"), "w", 0o755) do |f|
         f.puts <<~RUBY
           #!/usr/bin/env ruby
-          fetch_args = %w(fetch --force --quiet)
+          fetch_args = %w(fetch --force --quiet --no-tags)
           clone_args = %w(clone --bare --no-hardlinks --quiet)
 
-          if (fetch_args.-(ARGV).empty? || clone_args.-(ARGV).empty?) && ARGV.any? {|arg| arg.start_with?("file://") }
+          if (fetch_args.-(ARGV).empty? || clone_args.-(ARGV).empty?) && File.exist?(ARGV[ARGV.index("--") + 1])
             warn "git remote ops have been disabled"
             exit 1
           end
diff --git a/spec/bundler/install/deploy_spec.rb b/spec/bundler/install/deploy_spec.rb
index dfb352f170..7b6e775b4c 100644
--- a/spec/bundler/install/deploy_spec.rb
+++ b/spec/bundler/install/deploy_spec.rb
@@ -74,6 +74,18 @@ RSpec.describe "install in deployment or frozen mode" do
     end
   end
 
+  it "fails without a lockfile and says that deployment requires a lock" do
+    bundle "config deployment true"
+    bundle "install", raise_on_error: false
+    expect(err).to include("The deployment setting requires a lockfile")
+  end
+
+  it "fails without a lockfile and says that frozen requires a lock" do
+    bundle "config frozen true"
+    bundle "install", raise_on_error: false
+    expect(err).to include("The frozen setting requires a lockfile")
+  end
+
   it "still works if you are not in the app directory and specify --gemfile" do
     bundle "install"
     simulate_new_machine
diff --git a/spec/bundler/install/gemfile/sources_spec.rb b/spec/bundler/install/gemfile/sources_spec.rb
index f05e61f0b2..84af5c0d06 100644
--- a/spec/bundler/install/gemfile/sources_spec.rb
+++ b/spec/bundler/install/gemfile/sources_spec.rb
@@ -8,7 +8,7 @@ RSpec.describe "bundle install with gems on multiple sources" do
     before do
       # Oh no! Someone evil is trying to hijack myrack :(
       # need this to be broken to check for correct source ordering
-      build_repo gem_repo3 do
+      build_repo3 do
         build_gem "myrack", repo3_myrack_version do |s|
           s.write "lib/myrack.rb", "MYRACK = 'FAIL'"
         end
@@ -156,7 +156,7 @@ RSpec.describe "bundle install with gems on multiple sources" do
       before do
         # Oh no! Someone evil is trying to hijack myrack :(
         # need this to be broken to check for correct source ordering
-        build_repo gem_repo3 do
+        build_repo3 do
           build_gem "myrack", "1.0.0" do |s|
             s.write "lib/myrack.rb", "MYRACK = 'FAIL'"
           end
@@ -200,7 +200,7 @@ RSpec.describe "bundle install with gems on multiple sources" do
       before do
         # Oh no! Someone evil is trying to hijack myrack :(
         # need this to be broken to check for correct source ordering
-        build_repo gem_repo3 do
+        build_repo3 do
           build_gem "myrack", "1.0.0" do |s|
             s.write "lib/myrack.rb", "MYRACK = 'FAIL'"
           end
@@ -225,7 +225,7 @@ RSpec.describe "bundle install with gems on multiple sources" do
 
     context "when a pinned gem has an indirect dependency in the pinned source" do
       before do
-        build_repo gem_repo3 do
+        build_repo3 do
           build_gem "depends_on_myrack", "1.0.1" do |s|
             s.add_dependency "myrack"
           end
@@ -287,7 +287,7 @@ RSpec.describe "bundle install with gems on multiple sources" do
       before do
         # In these tests, we need a working myrack gem in repo2 and not repo3
 
-        build_repo gem_repo3 do
+        build_repo3 do
           build_gem "depends_on_myrack", "1.0.1" do |s|
             s.add_dependency "myrack"
           end
@@ -502,7 +502,7 @@ RSpec.describe "bundle install with gems on multiple sources" do
       before do
         build_repo2
 
-        build_repo gem_repo3 do
+        build_repo3 do
           build_gem "private_gem_1", "1.0.0"
           build_gem "private_gem_2", "1.0.0"
         end
@@ -528,7 +528,7 @@ RSpec.describe "bundle install with gems on multiple sources" do
       before do
         build_repo2
 
-        build_repo gem_repo3 do
+        build_repo3 do
           build_gem "depends_on_missing", "1.0.1" do |s|
             s.add_dependency "missing"
           end
@@ -565,7 +565,7 @@ RSpec.describe "bundle install with gems on multiple sources" do
           end
         end
 
-        build_repo gem_repo3 do
+        build_repo3 do
           build_gem "unrelated_gem", "1.0.0"
         end
 
@@ -645,7 +645,7 @@ RSpec.describe "bundle install with gems on multiple sources" do
 
     context "when a scoped gem has a deeply nested indirect dependency" do
       before do
-        build_repo gem_repo3 do
+        build_repo3 do
           build_gem "depends_on_depends_on_myrack", "1.0.1" do |s|
             s.add_dependency "depends_on_myrack"
           end
@@ -764,7 +764,7 @@ RSpec.describe "bundle install with gems on multiple sources" do
           build_gem "zeitwerk", "2.4.2"
         end
 
-        build_repo gem_repo3 do
+        build_repo3 do
           build_gem "sidekiq-pro", "5.2.1" do |s|
             s.add_dependency "connection_pool", ">= 2.2.3"
             s.add_dependency "sidekiq", ">= 6.1.0"
@@ -1080,7 +1080,7 @@ RSpec.describe "bundle install with gems on multiple sources" do
 
     context "when a pinned gem has an indirect dependency with more than one level of indirection in the default source " do
       before do
-        build_repo gem_repo3 do
+        build_repo3 do
           build_gem "handsoap", "0.2.5.5" do |s|
             s.add_dependency "nokogiri", ">= 1.2.3"
           end
@@ -1157,7 +1157,7 @@ RSpec.describe "bundle install with gems on multiple sources" do
 
     context "with a gem that is only found in the wrong source" do
       before do
-        build_repo gem_repo3 do
+        build_repo3 do
           build_gem "not_in_repo1", "1.0.0"
         end
 
@@ -1250,7 +1250,7 @@ RSpec.describe "bundle install with gems on multiple sources" do
       end
 
       before do
-        build_repo gem_repo3 do
+        build_repo3 do
           build_gem "myrack", "0.9.1"
         end
 
@@ -1393,7 +1393,7 @@ RSpec.describe "bundle install with gems on multiple sources" do
   context "re-resolving" do
     context "when there is a mix of sources in the gemfile" do
       before do
-        build_repo gem_repo3 do
+        build_repo3 do
           build_gem "myrack"
         end
 
@@ -1921,4 +1921,70 @@ RSpec.describe "bundle install with gems on multiple sources" do
       expect(err).to include("Could not find gem 'example' in rubygems repository https://gem.repo4/")
     end
   end
+
+  context "when a gem has versions in two sources, but only the locked one has updates" do
+    let(:original_lockfile) do
+      <<~L
+        GEM
+          remote: https://main.source/
+          specs:
+            activesupport (1.0)
+              bigdecimal
+            bigdecimal (1.0.0)
+
+        GEM
+          remote: https://main.source/extra/
+          specs:
+            foo (1.0)
+              bigdecimal
+
+        PLATFORMS
+          #{lockfile_platforms}
+
+        DEPENDENCIES
+          activesupport
+          foo!
+
+        BUNDLED WITH
+           #{Bundler::VERSION}
+      L
+    end
+
+    before do
+      build_repo3 do
+        build_gem "activesupport" do |s|
+          s.add_dependency "bigdecimal"
+        end
+
+        build_gem "bigdecimal", "1.0.0"
+        build_gem "bigdecimal", "3.3.1"
+      end
+
+      build_repo4 do
+        build_gem "foo" do |s|
+          s.add_dependency "bigdecimal"
+        end
+
+        build_gem "bigdecimal", "1.0.0"
+      end
+
+      gemfile <<~G
+        source "https://main.source"
+
+        gem "activesupport"
+
+        source "https://main.source/extra" do
+          gem "foo"
+        end
+      G
+
+      lockfile original_lockfile
+    end
+
+    it "properly upgrades the lockfile when updating that specific gem" do
+      bundle "update bigdecimal --conservative", artifice: "compact_index_extra_api", env: { "BUNDLER_SPEC_GEM_REPO" => gem_repo3.to_s }
+
+      expect(lockfile).to eq original_lockfile.gsub("bigdecimal (1.0.0)", "bigdecimal (3.3.1)")
+    end
+  end
 end
diff --git a/spec/bundler/install/git_spec.rb b/spec/bundler/install/git_spec.rb
index 179e6df4b4..caed4571e5 100644
--- a/spec/bundler/install/git_spec.rb
+++ b/spec/bundler/install/git_spec.rb
@@ -14,6 +14,19 @@ RSpec.describe "bundle install" do
       expect(the_bundle).to include_gems "foo 1.0", source: "git@#{lib_path("foo")}"
     end
 
+    it "displays the revision hash of the gem repository when passed a relative local path" do
+      build_git "foo", "1.0", path: lib_path("foo")
+
+      relative_path = lib_path("foo").relative_path_from(bundled_app)
+      install_gemfile <<-G, verbose: true
+        source "https://gem.repo1"
+        gem "foo", :git => "#{relative_path}"
+      G
+
+      expect(out).to include("Using foo 1.0 from #{relative_path} (at main@#{revision_for(lib_path("foo"))[0..6]})")
+      expect(the_bundle).to include_gems "foo 1.0", source: "git@#{lib_path("foo")}"
+    end
+
     it "displays the correct default branch", git: ">= 2.28.0" do
       build_git "foo", "1.0", path: lib_path("foo"), default_branch: "main"
 
diff --git a/spec/bundler/install/prereleases_spec.rb b/spec/bundler/install/prereleases_spec.rb
index cde27c14fc..57764ce722 100644
--- a/spec/bundler/install/prereleases_spec.rb
+++ b/spec/bundler/install/prereleases_spec.rb
@@ -38,7 +38,7 @@ RSpec.describe "bundle install" do
 
   describe "when prerelease gems are not available" do
     it "still works" do
-      build_repo gem_repo3 do
+      build_repo3 do
         build_gem "myrack"
       end
       FileUtils.rm_rf Dir[gem_repo3("prerelease*")]
diff --git a/spec/bundler/other/major_deprecation_spec.rb b/spec/bundler/other/major_deprecation_spec.rb
index 192dc7413e..f05a8c43f8 100644
--- a/spec/bundler/other/major_deprecation_spec.rb
+++ b/spec/bundler/other/major_deprecation_spec.rb
@@ -454,7 +454,7 @@ RSpec.describe "major deprecations" do
 
   context "bundle install in frozen mode with a lockfile with a single rubygems section with multiple remotes" do
     before do
-      build_repo gem_repo3 do
+      build_repo3 do
         build_gem "myrack", "0.9.1"
       end
 
diff --git a/spec/bundler/support/builders.rb b/spec/bundler/support/builders.rb
index e2a7aed219..a0b94004f2 100644
--- a/spec/bundler/support/builders.rb
+++ b/spec/bundler/support/builders.rb
@@ -188,9 +188,15 @@ module Spec
 
     # A repo that has no pre-installed gems included. (The caller completely
     # determines the contents with the block.)
+    def build_repo3(**kwargs, &blk)
+      build_empty_repo gem_repo3, **kwargs, &blk
+    end
+
+    # Like build_repo3, this is a repo that has no pre-installed gems included.
+    # We have two different methods for situations where two different empty
+    # sources are needed.
     def build_repo4(**kwargs, &blk)
-      FileUtils.rm_rf gem_repo4
-      build_repo(gem_repo4, **kwargs, &blk)
+      build_empty_repo gem_repo4, **kwargs, &blk
     end
 
     def update_repo4(&blk)
@@ -307,6 +313,11 @@ module Spec
 
     private
 
+    def build_empty_repo(gem_repo, **kwargs, &blk)
+      FileUtils.rm_rf gem_repo
+      build_repo(gem_repo, **kwargs, &blk)
+    end
+
     def build_with(builder, name, args, &blk)
       @_build_path ||= nil
       @_build_repo ||= nil
diff --git a/spec/bundler/support/rubygems_ext.rb b/spec/bundler/support/rubygems_ext.rb
index fb76e34a74..1fc5aa16c0 100644
--- a/spec/bundler/support/rubygems_ext.rb
+++ b/spec/bundler/support/rubygems_ext.rb
@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+abort "RubyGems only supports Ruby 3.0 or higher" if RUBY_VERSION < "3.0.0"
+
 require_relative "path"
 
 $LOAD_PATH.unshift(Spec::Path.source_lib_dir.to_s)