From 5f0ea3f590f8983669fe478bc9eace6880353b84 Mon Sep 17 00:00:00 2001 From: Martin Emde Date: Fri, 1 Dec 2023 14:20:51 -0800 Subject: [rubygems/rubygems] Converts Bundler lockfile checksum validation to opt-in only Looks for the CHECKSUMS section in the lockfile, activating the feature only if the section exists. Without a CHECKSUMS section, Bundler will continue as normal, validating checksums when gems are installed while checksums from the compact index are present. https://github.com/rubygems/rubygems/commit/2353cc93a4 --- lib/bundler/checksum.rb | 15 +- lib/bundler/definition.rb | 7 +- lib/bundler/endpoint_specification.rb | 1 - lib/bundler/lockfile_generator.rb | 1 + lib/bundler/lockfile_parser.rb | 15 +- lib/bundler/rubygems_gem_installer.rb | 10 +- spec/bundler/bundler/definition_spec.rb | 40 +-- spec/bundler/cache/gems_spec.rb | 31 +- spec/bundler/commands/check_spec.rb | 25 +- spec/bundler/commands/install_spec.rb | 43 ++- spec/bundler/commands/lock_spec.rb | 264 +++++++-------- spec/bundler/commands/update_spec.rb | 97 +++--- spec/bundler/install/gemfile/gemspec_spec.rb | 89 +++--- spec/bundler/install/gemfile/install_if_spec.rb | 15 +- spec/bundler/install/gemfile/path_spec.rb | 73 +++-- spec/bundler/install/gemfile/platform_spec.rb | 58 ++-- spec/bundler/install/gemfile/sources_spec.rb | 192 +++++------ .../install/gemfile/specific_platform_spec.rb | 164 +++++----- spec/bundler/install/gems/compact_index_spec.rb | 26 +- spec/bundler/install/gems/flex_spec.rb | 20 +- spec/bundler/install/gems/resolving_spec.rb | 33 +- spec/bundler/install/yanked_spec.rb | 4 - spec/bundler/lock/lockfile_spec.rb | 353 +++++++++------------ spec/bundler/plugins/source/example_spec.rb | 18 +- spec/bundler/runtime/platform_spec.rb | 15 +- spec/bundler/runtime/setup_spec.rb | 8 +- spec/bundler/support/checksums.rb | 68 +++- spec/bundler/update/git_spec.rb | 11 +- 28 files changed, 869 insertions(+), 827 deletions(-) diff --git a/lib/bundler/checksum.rb b/lib/bundler/checksum.rb index f8fd386569..163eac458e 100644 --- a/lib/bundler/checksum.rb +++ b/lib/bundler/checksum.rb @@ -9,6 +9,18 @@ module Bundler private_constant :DEFAULT_BLOCK_SIZE class << self + def from_gem_package(gem_package, algo = DEFAULT_ALGORITHM) + return if Bundler.settings[:disable_checksum_validation] + return unless source = gem_package.instance_variable_get(:@gem) + return unless source.respond_to?(:with_read_io) + + source.with_read_io do |io| + from_gem(io, source.path) + ensure + io.rewind + end + end + def from_gem(io, pathname, algo = DEFAULT_ALGORITHM) digest = Bundler::SharedHelpers.digest(algo.upcase).new buf = String.new(:capacity => DEFAULT_BLOCK_SIZE) @@ -17,6 +29,7 @@ module Bundler end def from_api(digest, source_uri, algo = DEFAULT_ALGORITHM) + return if Bundler.settings[:disable_checksum_validation] Checksum.new(algo, to_hexdigest(digest, algo), Source.new(:api, source_uri)) end @@ -177,7 +190,6 @@ module Bundler # This ensures a mismatch error where there are multiple top level sources # that contain the same gem with different checksums. def replace(spec, checksum) - return if Bundler.settings[:disable_checksum_validation] return unless checksum name_tuple = spec.name_tuple @@ -193,7 +205,6 @@ module Bundler end def register(spec, checksum) - return if Bundler.settings[:disable_checksum_validation] return unless checksum register_checksum(spec.name_tuple, checksum) end diff --git a/lib/bundler/definition.rb b/lib/bundler/definition.rb index ca12827579..3493f0732d 100644 --- a/lib/bundler/definition.rb +++ b/lib/bundler/definition.rb @@ -18,7 +18,8 @@ module Bundler :platforms, :ruby_version, :lockfile, - :gemfiles + :gemfiles, + :locked_checksums ) # Given a gemfile and lockfile creates a Bundler definition @@ -92,6 +93,7 @@ module Bundler @locked_bundler_version = @locked_gems.bundler_version @locked_ruby_version = @locked_gems.ruby_version @originally_locked_specs = SpecSet.new(@locked_gems.specs) + @locked_checksums = @locked_gems.checksums if unlock != true @locked_deps = @locked_gems.dependencies @@ -112,6 +114,7 @@ module Bundler @originally_locked_specs = @locked_specs @locked_sources = [] @locked_platforms = [] + @locked_checksums = nil end locked_gem_sources = @locked_sources.select {|s| s.is_a?(Source::Rubygems) } @@ -767,7 +770,7 @@ module Bundler sources.all_sources.each do |source| # has to be done separately, because we want to keep the locked checksum # store for a source, even when doing a full update - if @locked_gems && locked_source = @locked_gems.sources.find {|s| s == source && !s.equal?(source) } + if @locked_checksums && @locked_gems && locked_source = @locked_gems.sources.find {|s| s == source && !s.equal?(source) } source.checksum_store.merge!(locked_source.checksum_store) end # If the source is unlockable and the current command allows an unlock of diff --git a/lib/bundler/endpoint_specification.rb b/lib/bundler/endpoint_specification.rb index b639918f70..87cb352efa 100644 --- a/lib/bundler/endpoint_specification.rb +++ b/lib/bundler/endpoint_specification.rb @@ -125,7 +125,6 @@ module Bundler next unless v case k.to_s when "checksum" - next if Bundler.settings[:disable_checksum_validation] begin @checksum = Checksum.from_api(v.last, @spec_fetcher.uri) rescue ArgumentError => e diff --git a/lib/bundler/lockfile_generator.rb b/lib/bundler/lockfile_generator.rb index 4d2a968d7e..a646d00ee1 100644 --- a/lib/bundler/lockfile_generator.rb +++ b/lib/bundler/lockfile_generator.rb @@ -67,6 +67,7 @@ module Bundler end def add_checksums + return unless definition.locked_checksums checksums = definition.resolve.map do |spec| spec.source.checksum_store.to_lock(spec) end diff --git a/lib/bundler/lockfile_parser.rb b/lib/bundler/lockfile_parser.rb index 942f051052..1e11621e55 100644 --- a/lib/bundler/lockfile_parser.rb +++ b/lib/bundler/lockfile_parser.rb @@ -24,7 +24,15 @@ module Bundler end end - attr_reader :sources, :dependencies, :specs, :platforms, :bundler_version, :ruby_version, :checksums + attr_reader( + :sources, + :dependencies, + :specs, + :platforms, + :bundler_version, + :ruby_version, + :checksums, + ) BUNDLED = "BUNDLED WITH" DEPENDENCIES = "DEPENDENCIES" @@ -111,6 +119,9 @@ module Bundler elsif line == DEPENDENCIES @parse_method = :parse_dependency elsif line == CHECKSUMS + # This is a temporary solution to make this feature disabled by default + # for all gemfiles that don't already explicitly include the feature. + @checksums = true @parse_method = :parse_checksum elsif line == PLATFORMS @parse_method = :parse_platform @@ -228,8 +239,6 @@ module Bundler version = Gem::Version.new(version) platform = platform ? Gem::Platform.new(platform) : Gem::Platform::RUBY full_name = Gem::NameTuple.new(name, version, platform).full_name - # Don't raise exception if there's a checksum for a gem that's not in the lockfile, - # we prefer to heal invalid lockfiles return unless spec = @specs[full_name] checksums.split(",") do |lock_checksum| diff --git a/lib/bundler/rubygems_gem_installer.rb b/lib/bundler/rubygems_gem_installer.rb index d04ef62e8e..23fb3c0416 100644 --- a/lib/bundler/rubygems_gem_installer.rb +++ b/lib/bundler/rubygems_gem_installer.rb @@ -103,15 +103,7 @@ module Bundler end def gem_checksum - return nil if Bundler.settings[:disable_checksum_validation] - return nil unless source = @package.instance_variable_get(:@gem) - return nil unless source.respond_to?(:with_read_io) - - source.with_read_io do |io| - Checksum.from_gem(io, source.path) - ensure - io.rewind - end + Checksum.from_gem_package(@package) end private diff --git a/spec/bundler/bundler/definition_spec.rb b/spec/bundler/bundler/definition_spec.rb index 64856863ed..367cb7bcff 100644 --- a/spec/bundler/bundler/definition_spec.rb +++ b/spec/bundler/bundler/definition_spec.rb @@ -56,6 +56,11 @@ RSpec.describe Bundler::Definition do s.add_dependency "rack", "1.0" end + checksums = checksums_section_when_existing do |c| + c.no_checksum "foo", "1.0" + c.checksum gem_repo1, "rack", "1.0.0" + end + bundle :install, :env => { "DEBUG" => "1" } expect(out).to match(/re-resolving dependencies/) @@ -76,11 +81,7 @@ RSpec.describe Bundler::Definition do DEPENDENCIES foo! - - CHECKSUMS - #{gem_no_checksum "foo", "1.0"} - #{checksum_for_repo_gem gem_repo1, "rack", "1.0.0"} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} G @@ -110,6 +111,11 @@ RSpec.describe Bundler::Definition do s.add_development_dependency "net-ssh", "1.0" end + checksums = checksums_section_when_existing do |c| + c.no_checksum "foo", "1.0" + c.checksum gem_repo1, "rack", "1.0.0" + end + install_gemfile <<-G source "#{file_uri_for(gem_repo1)}" gem "foo", :path => "#{lib_path("foo")}" @@ -135,17 +141,17 @@ RSpec.describe Bundler::Definition do DEPENDENCIES foo! - - CHECKSUMS - #{gem_no_checksum "foo", "1.0"} - #{checksum_for_repo_gem gem_repo1, "rack", "1.0.0"} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} G end it "for a locked gem for another platform" do + checksums = checksums_section_when_existing do |c| + c.no_checksum "only_java", "1.1", "java" + end + install_gemfile <<-G source "#{file_uri_for(gem_repo1)}" gem "only_java", platform: :jruby @@ -166,16 +172,17 @@ RSpec.describe Bundler::Definition do DEPENDENCIES only_java - - CHECKSUMS - only_java (1.1-java) - + #{checksums} BUNDLED WITH #{Bundler::VERSION} G end it "for a rubygems gem" do + checksums = checksums_section_when_existing do |c| + c.checksum gem_repo1, "foo", "1.0" + end + install_gemfile <<-G source "#{file_uri_for(gem_repo1)}" gem "foo" @@ -195,10 +202,7 @@ RSpec.describe Bundler::Definition do DEPENDENCIES foo - - CHECKSUMS - #{checksum_for_repo_gem gem_repo1, "foo", "1.0"} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} G diff --git a/spec/bundler/cache/gems_spec.rb b/spec/bundler/cache/gems_spec.rb index 2f5da4e7e4..73c7db1e88 100644 --- a/spec/bundler/cache/gems_spec.rb +++ b/spec/bundler/cache/gems_spec.rb @@ -289,11 +289,24 @@ RSpec.describe "bundle cache" do expect(cached_gem("rack-1.0.0")).to exist end - it "raises an error when the gem file is altered and produces a different checksum" do + it "raises an error when the gem is altered and produces a different checksum" do cached_gem("rack-1.0.0").rmtree build_gem "rack", "1.0.0", :path => bundled_app("vendor/cache") + + checksums = checksums_section do |c| + c.checksum gem_repo1, "rack", "1.0.0" + end + simulate_new_machine + lockfile <<-L + GEM + remote: #{file_uri_for(gem_repo2)}/ + specs: + rack (1.0.0) + #{checksums} + L + bundle :install, :raise_on_error => false expect(exitstatus).to eq(37) expect(err).to include("Bundler found mismatched checksums.") @@ -305,6 +318,22 @@ RSpec.describe "bundle cache" do expect(cached_gem("rack-1.0.0")).to exist end + it "installs a modified gem with a non-matching checksum when checksums is not opted in" do + cached_gem("rack-1.0.0").rmtree + build_gem "rack", "1.0.0", :path => bundled_app("vendor/cache") + simulate_new_machine + + lockfile <<-L + GEM + remote: #{file_uri_for(gem_repo2)}/ + specs: + rack (1.0.0) + L + + bundle :install + expect(cached_gem("rack-1.0.0")).to exist + end + it "handles directories and non .gem files in the cache" do bundled_app("vendor/cache/foo").mkdir File.open(bundled_app("vendor/cache/bar"), "w") {|f| f.write("not a gem") } diff --git a/spec/bundler/commands/check_spec.rb b/spec/bundler/commands/check_spec.rb index dacbd6c45f..ca6a7d1e27 100644 --- a/spec/bundler/commands/check_spec.rb +++ b/spec/bundler/commands/check_spec.rb @@ -406,6 +406,12 @@ RSpec.describe "bundle check" do it "returns success when the Gemfile is satisfied and generates a correct lockfile" do system_gems "depends_on_rack-1.0", "rack-1.0", :gem_repo => gem_repo4, :path => default_bundle_path bundle :check + + checksums = checksums_section_when_existing do |c| + c.no_checksum "depends_on_rack", "1.0" + c.no_checksum "rack", "1.0" + end + expect(out).to include("The Gemfile's dependencies are satisfied") expect(lockfile).to eq <<~L GEM @@ -424,11 +430,7 @@ RSpec.describe "bundle check" do DEPENDENCIES depends_on_rack! - - CHECKSUMS - depends_on_rack (1.0) - rack (1.0) - + #{checksums} BUNDLED WITH #{Bundler::VERSION} L @@ -468,6 +470,12 @@ RSpec.describe "bundle check" do bundle "check --verbose", :dir => tmp.join("bundle-check-issue") + checksums = checksums_section_when_existing do |c| + c.checksum gem_repo4, "awesome_print", "1.0" + c.no_checksum "bundle-check-issue", "9999" + c.checksum gem_repo2, "dex-dispatch-engine", "1.0" + end + expect(File.read(tmp.join("bundle-check-issue/Gemfile.lock"))).to eq <<~L PATH remote: . @@ -491,12 +499,7 @@ RSpec.describe "bundle check" do DEPENDENCIES bundle-check-issue! dex-dispatch-engine! - - CHECKSUMS - #{checksum_for_repo_gem gem_repo4, "awesome_print", "1.0"} - bundle-check-issue (9999) - #{checksum_for_repo_gem gem_repo2, "dex-dispatch-engine", "1.0"} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} L diff --git a/spec/bundler/commands/install_spec.rb b/spec/bundler/commands/install_spec.rb index d570bac44a..66b618c2b1 100644 --- a/spec/bundler/commands/install_spec.rb +++ b/spec/bundler/commands/install_spec.rb @@ -622,6 +622,7 @@ RSpec.describe "bundle install with gem sources" do end it "writes current Ruby version to Gemfile.lock" do + checksums = checksums_section_when_existing expect(lockfile).to eq <<~L GEM remote: #{file_uri_for(gem_repo1)}/ @@ -631,9 +632,7 @@ RSpec.describe "bundle install with gem sources" do #{lockfile_platforms} DEPENDENCIES - - CHECKSUMS - + #{checksums} RUBY VERSION #{Bundler::RubyVersion.system} @@ -648,6 +647,8 @@ RSpec.describe "bundle install with gem sources" do source "#{file_uri_for(gem_repo1)}" G + checksums = checksums_section_when_existing + expect(lockfile).to eq <<~L GEM remote: #{file_uri_for(gem_repo1)}/ @@ -657,9 +658,7 @@ RSpec.describe "bundle install with gem sources" do #{lockfile_platforms} DEPENDENCIES - - CHECKSUMS - + #{checksums} RUBY VERSION #{Bundler::RubyVersion.system} @@ -1074,11 +1073,11 @@ RSpec.describe "bundle install with gem sources" do gem "loofah", "~> 2.12.0" G - checksums = checksum_section do |c| - c.repo_gem gem_repo4, "crass", "1.0.6" - c.repo_gem gem_repo4, "loofah", "2.12.0" - c.repo_gem gem_repo4, "nokogiri", "1.12.4", "x86_64-darwin" - c.repo_gem gem_repo4, "racca", "1.5.2" + checksums = checksums_section do |c| + c.checksum gem_repo4, "crass", "1.0.6" + c.checksum gem_repo4, "loofah", "2.12.0" + c.checksum gem_repo4, "nokogiri", "1.12.4", "x86_64-darwin" + c.checksum gem_repo4, "racca", "1.5.2" end lockfile <<-L @@ -1099,10 +1098,7 @@ RSpec.describe "bundle install with gem sources" do DEPENDENCIES loofah (~> 2.12.0) - - CHECKSUMS - #{checksums} - + #{checksums} RUBY VERSION #{Bundler::RubyVersion.system} @@ -1118,12 +1114,12 @@ RSpec.describe "bundle install with gem sources" do bundle "install", :artifice => "compact_index" end - expected_checksums = checksum_section do |c| - c.repo_gem gem_repo4, "crass", "1.0.6" - c.repo_gem gem_repo4, "loofah", "2.12.0" - c.repo_gem gem_repo4, "nokogiri", "1.12.4", "x86_64-darwin" - c.repo_gem gem_repo4, "nokogiri", "1.12.4", "x86_64-linux" - c.repo_gem gem_repo4, "racca", "1.5.2" + checksums = checksums_section_when_existing do |c| + c.checksum gem_repo4, "crass", "1.0.6" + c.checksum gem_repo4, "loofah", "2.12.0" + c.checksum gem_repo4, "nokogiri", "1.12.4", "x86_64-darwin" + c.checksum gem_repo4, "racca", "1.5.2" + c.checksum gem_repo4, "nokogiri", "1.12.4", "x86_64-linux" end expect(lockfile).to eq <<~L @@ -1146,10 +1142,7 @@ RSpec.describe "bundle install with gem sources" do DEPENDENCIES loofah (~> 2.12.0) - - CHECKSUMS - #{expected_checksums} - + #{checksums} RUBY VERSION #{Bundler::RubyVersion.system} diff --git a/spec/bundler/commands/lock_spec.rb b/spec/bundler/commands/lock_spec.rb index 5c6a2c0e3d..e4d44f09f5 100644 --- a/spec/bundler/commands/lock_spec.rb +++ b/spec/bundler/commands/lock_spec.rb @@ -11,16 +11,16 @@ RSpec.describe "bundle lock" do gem "foo" G - expected_checksums = checksum_section do |c| - c.repo_gem repo, "actionmailer", "2.3.2" - c.repo_gem repo, "actionpack", "2.3.2" - c.repo_gem repo, "activerecord", "2.3.2" - c.repo_gem repo, "activeresource", "2.3.2" - c.repo_gem repo, "activesupport", "2.3.2" - c.repo_gem repo, "foo", "1.0" - c.repo_gem repo, "rails", "2.3.2" - c.repo_gem repo, "rake", "13.0.1" - c.repo_gem repo, "weakling", "0.0.3" + checksums = checksums_section_when_existing do |c| + c.checksum repo, "actionmailer", "2.3.2" + c.checksum repo, "actionpack", "2.3.2" + c.checksum repo, "activerecord", "2.3.2" + c.checksum repo, "activeresource", "2.3.2" + c.checksum repo, "activesupport", "2.3.2" + c.checksum repo, "foo", "1.0" + c.checksum repo, "rails", "2.3.2" + c.checksum repo, "rake", "13.0.1" + c.checksum repo, "weakling", "0.0.3" end @lockfile = <<~L @@ -53,10 +53,7 @@ RSpec.describe "bundle lock" do foo rails weakling - - CHECKSUMS - #{expected_checksums} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} L @@ -65,12 +62,18 @@ RSpec.describe "bundle lock" do it "prints a lockfile when there is no existing lockfile with --print" do bundle "lock --print" - # No checksums because no way to get them from a file uri source - # + no existing lockfile that has them - expect(out).to eq(remove_checksums_from_lockfile(@lockfile.chomp)) + expect(out).to eq(@lockfile.chomp) end it "prints a lockfile when there is an existing lockfile with --print" do + lockfile remove_checksums_section_from_lockfile(@lockfile) + + bundle "lock --print" + + expect(out).to eq(remove_checksums_section_from_lockfile(@lockfile).chomp) + end + + it "prints a lockfile when there is an existing checksums lockfile with --print" do lockfile @lockfile bundle "lock --print" @@ -81,26 +84,39 @@ RSpec.describe "bundle lock" do it "writes a lockfile when there is no existing lockfile" do bundle "lock" - # No checksums because no way to get them from a file uri source - # + no existing lockfile that has them - expect(read_lockfile).to eq(remove_checksums_from_lockfile(@lockfile)) + expect(read_lockfile).to eq(@lockfile) + end + + it "prints a lockfile without fetching new checksums if the existing lockfile had no checksums" do + lockfile remove_checksums_from_lockfile(@lockfile) + + bundle "lock --print" + + expect(out).to eq(remove_checksums_from_lockfile(@lockfile).chomp) end it "writes a lockfile when there is an outdated lockfile using --update" do + lockfile remove_checksums_from_lockfile(@lockfile.gsub("2.3.2", "2.3.1"), " (2.3.1)") + + bundle "lock --update" + + expect(read_lockfile).to eq(remove_checksums_from_lockfile(@lockfile)) + end + + it "writes a lockfile with checksums on --update when checksums exist" do lockfile @lockfile.gsub("2.3.2", "2.3.1") bundle "lock --update" - expect(read_lockfile).to eq(remove_checksums_from_lockfile(@lockfile, "(2.3.2)")) + expect(read_lockfile).to eq(@lockfile) end - it "writes a lockfile when there is an outdated lockfile using a bundle is frozen" do + it "writes a lockfile when there is an outdated lockfile and bundle is frozen" do lockfile @lockfile.gsub("2.3.2", "2.3.1") bundle "lock --update", :env => { "BUNDLE_FROZEN" => "true" } - # No checksums for the updated gems - expect(read_lockfile).to eq(remove_checksums_from_lockfile(@lockfile, "(2.3.2)")) + expect(read_lockfile).to eq(@lockfile) end it "does not fetch remote specs when using the --local option" do @@ -109,11 +125,24 @@ RSpec.describe "bundle lock" do expect(err).to match(/locally installed gems/) end + it "does not fetch remote checksums with --local" do + lockfile remove_checksums_from_lockfile(@lockfile) + + bundle "lock --print --local" + + # No checksums because --local prevents fetching them + expect(out).to eq(remove_checksums_from_lockfile(@lockfile).chomp) + end + it "works with --gemfile flag" do create_file "CustomGemfile", <<-G source "#{file_uri_for(repo)}" gem "foo" G + checksums = checksums_section_when_existing do |c| + c.no_checksum "foo", "1.0" + end + lockfile = <<~L GEM remote: #{file_uri_for(repo)}/ @@ -125,10 +154,7 @@ RSpec.describe "bundle lock" do DEPENDENCIES foo - - CHECKSUMS - #{gem_no_checksum "foo", "1.0"} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} L @@ -151,16 +177,16 @@ RSpec.describe "bundle lock" do bundle "install" bundle "lock --lockfile=lock" - expected_checksums = checksum_section do |c| - c.repo_gem repo, "actionmailer", "2.3.2" - c.repo_gem repo, "actionpack", "2.3.2" - c.repo_gem repo, "activerecord", "2.3.2" - c.repo_gem repo, "activeresource", "2.3.2" - c.repo_gem repo, "activesupport", "2.3.2" - c.repo_gem repo, "foo", "1.0" - c.repo_gem repo, "rails", "2.3.2" - c.repo_gem repo, "rake", "13.0.1" - c.repo_gem repo, "weakling", "0.0.3" + checksums = checksums_section_when_existing do |c| + c.checksum repo, "actionmailer", "2.3.2" + c.checksum repo, "actionpack", "2.3.2" + c.checksum repo, "activerecord", "2.3.2" + c.checksum repo, "activeresource", "2.3.2" + c.checksum repo, "activesupport", "2.3.2" + c.checksum repo, "foo", "1.0" + c.checksum repo, "rails", "2.3.2" + c.checksum repo, "rake", "13.0.1" + c.checksum repo, "weakling", "0.0.3" end lockfile = <<~L @@ -193,10 +219,7 @@ RSpec.describe "bundle lock" do foo rails weakling - - CHECKSUMS - #{expected_checksums} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} L @@ -510,6 +533,11 @@ RSpec.describe "bundle lock" do end end + checksums = checksums_section_when_existing do |c| + c.checksum gem_repo4, "nokogiri", "1.12.0" + c.checksum gem_repo4, "nokogiri", "1.12.0", "x86_64-darwin" + end + simulate_platform "x86_64-darwin-22" do install_gemfile <<~G source "#{file_uri_for(gem_repo4)}" @@ -531,15 +559,13 @@ RSpec.describe "bundle lock" do DEPENDENCIES nokogiri - - CHECKSUMS - #{checksum_for_repo_gem gem_repo4, "nokogiri", "1.12.0"} - #{checksum_for_repo_gem gem_repo4, "nokogiri", "1.12.0", "x86_64-darwin"} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} L + checksums.delete("nokogiri", Gem::Platform::RUBY) + simulate_platform "x86_64-darwin-22" do bundle "lock --remove-platform ruby" end @@ -555,10 +581,7 @@ RSpec.describe "bundle lock" do DEPENDENCIES nokogiri - - CHECKSUMS - #{checksum_for_repo_gem gem_repo4, "nokogiri", "1.12.0", "x86_64-darwin"} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} L @@ -606,6 +629,13 @@ RSpec.describe "bundle lock" do gem "gssapi" G + checksums = checksums_section_when_existing do |c| + c.no_checksum "ffi", "1.9.14", "x86-mingw32" + c.no_checksum "gssapi", "1.2.0" + c.no_checksum "mixlib-shellout", "2.2.6", "universal-mingw32" + c.no_checksum "win32-process", "0.8.3" + end + simulate_platform(x86_mingw32) { bundle :lock } expect(lockfile).to eq <<~G @@ -626,13 +656,7 @@ RSpec.describe "bundle lock" do DEPENDENCIES gssapi mixlib-shellout - - CHECKSUMS - #{gem_no_checksum "ffi", "1.9.14", "x86-mingw32"} - #{gem_no_checksum "gssapi", "1.2.0"} - #{gem_no_checksum "mixlib-shellout", "2.2.6", "universal-mingw32"} - #{gem_no_checksum "win32-process", "0.8.3"} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} G @@ -640,6 +664,9 @@ RSpec.describe "bundle lock" do bundle "config set --local force_ruby_platform true" bundle :lock + checksums.no_checksum "ffi", "1.9.14" + checksums.no_checksum "mixlib-shellout", "2.2.6" + expect(lockfile).to eq <<~G GEM remote: #{file_uri_for(gem_repo4)}/ @@ -661,15 +688,7 @@ RSpec.describe "bundle lock" do DEPENDENCIES gssapi mixlib-shellout - - CHECKSUMS - #{gem_no_checksum "ffi", "1.9.14"} - #{gem_no_checksum "ffi", "1.9.14", "x86-mingw32"} - #{gem_no_checksum "gssapi", "1.2.0"} - #{gem_no_checksum "mixlib-shellout", "2.2.6"} - #{gem_no_checksum "mixlib-shellout", "2.2.6", "universal-mingw32"} - #{gem_no_checksum "win32-process", "0.8.3"} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} G @@ -735,6 +754,11 @@ RSpec.describe "bundle lock" do simulate_platform(Gem::Platform.new("x86_64-darwin-19")) { bundle "lock" } + checksums = checksums_section_when_existing do |c| + c.no_checksum "libv8", "8.4.255.0", "x86_64-darwin-19" + c.no_checksum "libv8", "8.4.255.0", "x86_64-darwin-20" + end + expect(lockfile).to eq <<~G GEM remote: #{file_uri_for(gem_repo4)}/ @@ -748,11 +772,7 @@ RSpec.describe "bundle lock" do DEPENDENCIES libv8 - - CHECKSUMS - #{gem_no_checksum "libv8", "8.4.255.0", "x86_64-darwin-19"} - #{gem_no_checksum "libv8", "8.4.255.0", "x86_64-darwin-20"} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} G @@ -769,6 +789,11 @@ RSpec.describe "bundle lock" do end end + checksums = checksums_section_when_existing do |c| + c.checksum gem_repo4, "libv8", "8.4.255.0", "x86_64-darwin-19" + c.checksum gem_repo4, "libv8", "8.4.255.0", "x86_64-darwin-20" + end + gemfile <<-G source "#{file_uri_for(gem_repo4)}" @@ -787,11 +812,7 @@ RSpec.describe "bundle lock" do DEPENDENCIES libv8 - - CHECKSUMS - #{checksum_for_repo_gem gem_repo4, "libv8", "8.4.255.0", "x86_64-darwin-19"} - #{checksum_for_repo_gem gem_repo4, "libv8", "8.4.255.0", "x86_64-darwin-20"} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} G @@ -960,16 +981,16 @@ RSpec.describe "bundle lock" do it "does not implicitly update" do bundle "lock" - expected_checksums = checksum_section do |c| - c.repo_gem repo, "actionmailer", "2.3.2" - c.repo_gem repo, "actionpack", "2.3.2" - c.repo_gem repo, "activerecord", "2.3.2" - c.repo_gem repo, "activeresource", "2.3.2" - c.repo_gem repo, "activesupport", "2.3.2" - c.repo_gem repo, "foo", "1.0" - c.repo_gem repo, "rails", "2.3.2" - c.repo_gem repo, "rake", "13.0.1" - c.repo_gem repo, "weakling", "0.0.3" + checksums = checksums_section_when_existing do |c| + c.checksum repo, "actionmailer", "2.3.2" + c.checksum repo, "actionpack", "2.3.2" + c.checksum repo, "activerecord", "2.3.2" + c.checksum repo, "activeresource", "2.3.2" + c.checksum repo, "activesupport", "2.3.2" + c.checksum repo, "foo", "1.0" + c.checksum repo, "rails", "2.3.2" + c.checksum repo, "rake", "13.0.1" + c.checksum repo, "weakling", "0.0.3" end expected_lockfile = <<~L @@ -1002,10 +1023,7 @@ RSpec.describe "bundle lock" do foo rails weakling - - CHECKSUMS - #{expected_checksums} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} L @@ -1017,16 +1035,16 @@ RSpec.describe "bundle lock" do gemfile gemfile.gsub('"foo"', '"foo", "2.0"') bundle "lock" - expected_checksums = checksum_section do |c| - c.repo_gem repo, "actionmailer", "2.3.2" - c.repo_gem repo, "actionpack", "2.3.2" - c.repo_gem repo, "activerecord", "2.3.2" - c.repo_gem repo, "activeresource", "2.3.2" - c.repo_gem repo, "activesupport", "2.3.2" + checksums = checksums_section_when_existing do |c| + c.checksum repo, "actionmailer", "2.3.2" + c.checksum repo, "actionpack", "2.3.2" + c.checksum repo, "activerecord", "2.3.2" + c.checksum repo, "activeresource", "2.3.2" + c.checksum repo, "activesupport", "2.3.2" c.no_checksum "foo", "2.0" - c.repo_gem repo, "rails", "2.3.2" - c.repo_gem repo, "rake", "13.0.1" - c.repo_gem repo, "weakling", "0.0.3" + c.checksum repo, "rails", "2.3.2" + c.checksum repo, "rake", "13.0.1" + c.checksum repo, "weakling", "0.0.3" end expected_lockfile = <<~L @@ -1059,10 +1077,7 @@ RSpec.describe "bundle lock" do foo (= 2.0) rails weakling - - CHECKSUMS - #{expected_checksums} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} L @@ -1111,9 +1126,7 @@ RSpec.describe "bundle lock" do DEPENDENCIES debug - - CHECKSUMS - + #{checksums_section} BUNDLED WITH #{Bundler::VERSION} L @@ -1122,6 +1135,11 @@ RSpec.describe "bundle lock" do bundle "lock" end + checksums = checksums_section do |c| + c.no_checksum "debug", "1.6.3" + c.no_checksum "irb", "1.5.0" + end + expect(lockfile).to eq <<~L GEM remote: #{file_uri_for(gem_repo4)}/ @@ -1136,11 +1154,7 @@ RSpec.describe "bundle lock" do DEPENDENCIES debug - - CHECKSUMS - #{gem_no_checksum "debug", "1.6.3"} - #{gem_no_checksum "irb", "1.5.0"} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} L @@ -1422,6 +1436,11 @@ RSpec.describe "bundle lock" do end it "locks ruby specs" do + checksums = checksums_section_when_existing do |c| + c.no_checksum "foo", "1.0" + c.no_checksum "nokogiri", "1.14.2" + end + simulate_platform "x86_64-linux" do bundle "lock" end @@ -1443,11 +1462,7 @@ RSpec.describe "bundle lock" do DEPENDENCIES foo! - - CHECKSUMS - #{gem_no_checksum "foo", "1.0"} - #{gem_no_checksum "nokogiri", "1.14.2"} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} L @@ -1508,6 +1523,13 @@ RSpec.describe "bundle lock" do end it "does not downgrade top level dependencies" do + checksums = checksums_section_when_existing do |c| + c.no_checksum "actionpack", "7.0.4.3" + c.no_checksum "activesupport", "7.0.4.3" + c.no_checksum "govuk_app_config", "4.13.0" + c.no_checksum "railties", "7.0.4.3" + end + simulate_platform "arm64-darwin-22" do bundle "lock" end @@ -1530,13 +1552,7 @@ RSpec.describe "bundle lock" do DEPENDENCIES activesupport (= 7.0.4.3) govuk_app_config - - CHECKSUMS - #{gem_no_checksum "actionpack", "7.0.4.3"} - #{gem_no_checksum "activesupport", "7.0.4.3"} - #{gem_no_checksum "govuk_app_config", "4.13.0"} - #{gem_no_checksum "railties", "7.0.4.3"} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} L diff --git a/spec/bundler/commands/update_spec.rb b/spec/bundler/commands/update_spec.rb index 5c7b569fe2..c7b6934526 100644 --- a/spec/bundler/commands/update_spec.rb +++ b/spec/bundler/commands/update_spec.rb @@ -275,6 +275,11 @@ RSpec.describe "bundle update" do gem "countries" G + checksums = checksums_section_when_existing do |c| + c.checksum(gem_repo4, "countries", "3.1.0") + c.checksum(gem_repo4, "country_select", "5.1.0") + end + lockfile <<~L GEM remote: #{file_uri_for(gem_repo4)}/ @@ -289,11 +294,7 @@ RSpec.describe "bundle update" do DEPENDENCIES countries country_select - - CHECKSUMS - #{checksum_for_repo_gem(gem_repo4, "countries", "3.1.0")} - #{checksum_for_repo_gem(gem_repo4, "country_select", "5.1.0")} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} L @@ -509,9 +510,9 @@ RSpec.describe "bundle update" do original_lockfile = lockfile - expected_checksums = checksum_section do |c| - c.repo_gem gem_repo4, "activesupport", "6.0.4.1" - c.repo_gem gem_repo4, "tzinfo", "1.2.9" + checksums = checksums_section_when_existing do |c| + c.checksum gem_repo4, "activesupport", "6.0.4.1" + c.checksum gem_repo4, "tzinfo", "1.2.9" end expected_lockfile = <<~L @@ -527,10 +528,7 @@ RSpec.describe "bundle update" do DEPENDENCIES activesupport (~> 6.0.0) - - CHECKSUMS - #{expected_checksums} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} L @@ -1152,9 +1150,10 @@ RSpec.describe "bundle update --ruby" do G gemfile <<-G - source "#{file_uri_for(gem_repo1)}" + source "#{file_uri_for(gem_repo1)}" G end + it "removes the Ruby from the Gemfile.lock" do bundle "update --ruby" @@ -1168,8 +1167,6 @@ RSpec.describe "bundle update --ruby" do DEPENDENCIES - CHECKSUMS - BUNDLED WITH #{Bundler::VERSION} L @@ -1184,30 +1181,29 @@ RSpec.describe "bundle update --ruby" do G gemfile <<-G - ruby '~> #{current_ruby_minor}' - source "#{file_uri_for(gem_repo1)}" + ruby '~> #{current_ruby_minor}' + source "#{file_uri_for(gem_repo1)}" G end + it "updates the Gemfile.lock with the latest version" do bundle "update --ruby" expect(lockfile).to eq <<~L - GEM - remote: #{file_uri_for(gem_repo1)}/ - specs: - - PLATFORMS - #{lockfile_platforms} + GEM + remote: #{file_uri_for(gem_repo1)}/ + specs: - DEPENDENCIES + PLATFORMS + #{lockfile_platforms} - CHECKSUMS + DEPENDENCIES - RUBY VERSION - #{Bundler::RubyVersion.system} + RUBY VERSION + #{Bundler::RubyVersion.system} - BUNDLED WITH - #{Bundler::VERSION} + BUNDLED WITH + #{Bundler::VERSION} L end end @@ -1257,6 +1253,7 @@ RSpec.describe "bundle update --ruby" do source "#{file_uri_for(gem_repo1)}" G end + it "updates the Gemfile.lock with the latest version" do bundle "update --ruby" @@ -1288,11 +1285,14 @@ RSpec.describe "bundle update --bundler" do build_gem "rack", "1.0" end + checksums = checksums_section_when_existing do |c| + c.checksum(gem_repo4, "rack", "1.0") + end + install_gemfile <<-G source "#{file_uri_for(gem_repo4)}" gem "rack" G - expected_checksum = checksum_for_repo_gem(gem_repo4, "rack", "1.0") expect(lockfile).to eq <<~L GEM remote: #{file_uri_for(gem_repo4)}/ @@ -1304,10 +1304,7 @@ RSpec.describe "bundle update --bundler" do DEPENDENCIES rack - - CHECKSUMS - #{expected_checksum} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} L @@ -1327,10 +1324,7 @@ RSpec.describe "bundle update --bundler" do DEPENDENCIES rack - - CHECKSUMS - #{expected_checksum} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} L @@ -1351,6 +1345,10 @@ RSpec.describe "bundle update --bundler" do G lockfile lockfile.sub(/(^\s*)#{Bundler::VERSION}($)/, "2.3.9") + checksums = checksums_section_when_existing do |c| + c.checksum(gem_repo4, "rack", "1.0") + end + bundle :update, :bundler => true, :artifice => "compact_index", :verbose => true expect(out).to include("Using bundler #{Bundler::VERSION}") @@ -1365,10 +1363,7 @@ RSpec.describe "bundle update --bundler" do DEPENDENCIES rack - - CHECKSUMS - #{checksum_for_repo_gem(gem_repo4, "rack", "1.0")} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} L @@ -1458,8 +1453,11 @@ RSpec.describe "bundle update --bundler" do bundle :update, :bundler => "2.3.0.dev", :verbose => "true" # Only updates properly on modern RubyGems. - if Gem.rubygems_version >= Gem::Version.new("3.3.0.dev") + checksums = checksums_section_when_existing do |c| + c.checksum(gem_repo4, "rack", "1.0") + end + expect(lockfile).to eq <<~L GEM remote: #{file_uri_for(gem_repo4)}/ @@ -1471,10 +1469,7 @@ RSpec.describe "bundle update --bundler" do DEPENDENCIES rack - - CHECKSUMS - #{checksum_for_repo_gem(gem_repo4, "rack", "1.0")} - + #{checksums} BUNDLED WITH 2.3.0.dev L @@ -1500,6 +1495,9 @@ RSpec.describe "bundle update --bundler" do expect(out).not_to include("Fetching gem metadata from https://rubygems.org/") # Only updates properly on modern RubyGems. + checksums = checksums_section_when_existing do |c| + c.checksum(gem_repo4, "rack", "1.0") + end if Gem.rubygems_version >= Gem::Version.new("3.3.0.dev") expect(lockfile).to eq <<~L @@ -1513,10 +1511,7 @@ RSpec.describe "bundle update --bundler" do DEPENDENCIES rack - - CHECKSUMS - #{checksum_for_repo_gem(gem_repo4, "rack", "1.0")} - + #{checksums} BUNDLED WITH 2.3.9 L diff --git a/spec/bundler/install/gemfile/gemspec_spec.rb b/spec/bundler/install/gemfile/gemspec_spec.rb index ae53130bf3..c79e275d2b 100644 --- a/spec/bundler/install/gemfile/gemspec_spec.rb +++ b/spec/bundler/install/gemfile/gemspec_spec.rb @@ -28,14 +28,14 @@ RSpec.describe "bundle install from an existing gemspec" do x64_mingw_archs.join("\n ") end - let(:x64_mingw_checksums) do - x64_mingw_archs.map do |arch| + def x64_mingw_checksums(checksums) + x64_mingw_archs.each do |arch| if arch == "x64-mingw-ucrt" - gem_no_checksum "platform_specific", "1.0", arch + checksums.no_checksum "platform_specific", "1.0", arch else - checksum_for_repo_gem gem_repo2, "platform_specific", "1.0", arch + checksums.checksum gem_repo2, "platform_specific", "1.0", arch end - end.join("\n ") + end end it "should install runtime and development dependencies" do @@ -368,6 +368,10 @@ RSpec.describe "bundle install from an existing gemspec" do gemspec :path => "../foo" G + checksums = checksums_section_when_existing do |c| + c.no_checksum "foo", "1.0" + end + lockfile <<-L PATH remote: ../foo @@ -385,7 +389,7 @@ RSpec.describe "bundle install from an existing gemspec" do DEPENDENCIES foo! - + #{checksums} BUNDLED WITH #{Bundler::VERSION} L @@ -459,6 +463,13 @@ RSpec.describe "bundle install from an existing gemspec" do it "keeps all platform dependencies in the lockfile" do expect(the_bundle).to include_gems "foo 1.0", "platform_specific 1.0 RUBY" + checksums = checksums_section_when_existing do |c| + c.no_checksum "foo", "1.0" + c.checksum gem_repo2, "platform_specific", "1.0" + c.checksum gem_repo2, "platform_specific", "1.0", "java" + x64_mingw_checksums(c) + end + expect(lockfile).to eq <<~L PATH remote: . @@ -480,13 +491,7 @@ RSpec.describe "bundle install from an existing gemspec" do DEPENDENCIES foo! - - CHECKSUMS - foo (1.0) - #{checksum_for_repo_gem gem_repo2, "platform_specific", "1.0"} - #{checksum_for_repo_gem gem_repo2, "platform_specific", "1.0", "java"} - #{x64_mingw_checksums} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} L @@ -499,6 +504,13 @@ RSpec.describe "bundle install from an existing gemspec" do it "keeps all platform dependencies in the lockfile" do expect(the_bundle).to include_gems "foo 1.0", "platform_specific 1.0 RUBY" + checksums = checksums_section_when_existing do |c| + c.no_checksum "foo", "1.0" + c.checksum gem_repo2, "platform_specific", "1.0" + c.checksum gem_repo2, "platform_specific", "1.0", "java" + x64_mingw_checksums(c) + end + expect(lockfile).to eq <<~L PATH remote: . @@ -520,13 +532,7 @@ RSpec.describe "bundle install from an existing gemspec" do DEPENDENCIES foo! platform_specific - - CHECKSUMS - foo (1.0) - #{checksum_for_repo_gem gem_repo2, "platform_specific", "1.0"} - #{checksum_for_repo_gem gem_repo2, "platform_specific", "1.0", "java"} - #{x64_mingw_checksums} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} L @@ -540,6 +546,14 @@ RSpec.describe "bundle install from an existing gemspec" do it "keeps all platform dependencies in the lockfile" do expect(the_bundle).to include_gems "foo 1.0", "indirect_platform_specific 1.0", "platform_specific 1.0 RUBY" + checksums = checksums_section_when_existing do |c| + c.no_checksum "foo", "1.0" + c.checksum gem_repo2, "indirect_platform_specific", "1.0" + c.checksum gem_repo2, "platform_specific", "1.0" + c.checksum gem_repo2, "platform_specific", "1.0", "java" + x64_mingw_checksums(c) + end + expect(lockfile).to eq <<~L PATH remote: . @@ -563,14 +577,7 @@ RSpec.describe "bundle install from an existing gemspec" do DEPENDENCIES foo! indirect_platform_specific - - CHECKSUMS - foo (1.0) - #{checksum_for_repo_gem gem_repo2, "indirect_platform_specific", "1.0"} - #{checksum_for_repo_gem gem_repo2, "platform_specific", "1.0"} - #{checksum_for_repo_gem gem_repo2, "platform_specific", "1.0", "java"} - #{x64_mingw_checksums} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} L @@ -634,6 +641,12 @@ RSpec.describe "bundle install from an existing gemspec" do gemspec :path => "../chef" G + checksums = checksums_section_when_existing do |c| + c.no_checksum "chef", "17.1.17" + c.no_checksum "chef", "17.1.17", "universal-mingw32" + c.checksum gem_repo4, "win32-api", "1.5.3", "universal-mingw32" + end + initial_lockfile = <<~L PATH remote: ../chef @@ -654,12 +667,7 @@ RSpec.describe "bundle install from an existing gemspec" do DEPENDENCIES chef! - - CHECKSUMS - chef (17.1.17) - chef (17.1.17-universal-mingw32) - #{checksum_for_repo_gem gem_repo4, "win32-api", "1.5.3", "universal-mingw32"} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} L @@ -697,6 +705,12 @@ RSpec.describe "bundle install from an existing gemspec" do end it "does not remove the platform specific specs from the lockfile when re-resolving due to gemspec changes" do + checksums = checksums_section_when_existing do |c| + c.no_checksum "activeadmin", "2.9.0" + c.no_checksum "jruby-openssl", "0.10.7", "java" + c.checksum gem_repo4, "railties", "6.1.4" + end + expect(lockfile).to eq <<~L PATH remote: ../activeadmin @@ -716,12 +730,7 @@ RSpec.describe "bundle install from an existing gemspec" do DEPENDENCIES activeadmin! jruby-openssl - - CHECKSUMS - activeadmin (2.9.0) - jruby-openssl (0.10.7-java) - #{checksum_for_repo_gem gem_repo4, "railties", "6.1.4"} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} L diff --git a/spec/bundler/install/gemfile/install_if_spec.rb b/spec/bundler/install/gemfile/install_if_spec.rb index c8ddb685ff..c7640d07e1 100644 --- a/spec/bundler/install/gemfile/install_if_spec.rb +++ b/spec/bundler/install/gemfile/install_if_spec.rb @@ -18,6 +18,13 @@ RSpec.describe "bundle install with install_if conditionals" do expect(the_bundle).not_to include_gems("thin") expect(the_bundle).not_to include_gems("foo") + checksums = checksums_section_when_existing do |c| + c.checksum gem_repo1, "activesupport", "2.3.5" + c.no_checksum "foo", "1.0" + c.checksum gem_repo1, "rack", "1.0.0" + c.no_checksum "thin", "1.0" + end + expect(lockfile).to eq <<~L GEM remote: #{file_uri_for(gem_repo1)}/ @@ -36,13 +43,7 @@ RSpec.describe "bundle install with install_if conditionals" do foo rack thin - - CHECKSUMS - #{checksum_for_repo_gem gem_repo1, "activesupport", "2.3.5"} - #{gem_no_checksum "foo", "1.0"} - #{checksum_for_repo_gem gem_repo1, "rack", "1.0.0"} - #{gem_no_checksum "thin", "1.0"} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} L diff --git a/spec/bundler/install/gemfile/path_spec.rb b/spec/bundler/install/gemfile/path_spec.rb index 3af8412eab..d6e008a7c4 100644 --- a/spec/bundler/install/gemfile/path_spec.rb +++ b/spec/bundler/install/gemfile/path_spec.rb @@ -98,6 +98,11 @@ RSpec.describe "bundle install with explicit source paths" do gem "aaa", :path => "./aaa" G + checksums = checksums_section_when_existing do |c| + c.no_checksum "aaa", "1.0" + c.no_checksum "demo", "1.0" + end + lockfile = <<~L PATH remote: . @@ -119,11 +124,7 @@ RSpec.describe "bundle install with explicit source paths" do DEPENDENCIES aaa! demo! - - CHECKSUMS - #{gem_no_checksum("aaa", "1.0")} - #{gem_no_checksum("demo", "1.0")} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} L @@ -345,6 +346,11 @@ RSpec.describe "bundle install with explicit source paths" do lockfile_path = lib_path("foo/Gemfile.lock") + checksums = checksums_section_when_existing do |c| + c.no_checksum "foo", "0.1.0" + c.checksum gem_repo4, "graphql", "2.0.15" + end + original_lockfile = <<~L PATH remote: . @@ -362,11 +368,7 @@ RSpec.describe "bundle install with explicit source paths" do DEPENDENCIES foo! - - CHECKSUMS - #{gem_no_checksum("foo", "0.1.0")} - #{checksum_for_repo_gem(gem_repo4, "graphql", "2.0.15")} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} L @@ -673,6 +675,11 @@ RSpec.describe "bundle install with explicit source paths" do expect(the_bundle).to include_gems "rack 0.9.1" + checksums = checksums_section_when_existing do |c| + c.no_checksum "foo", "1.0" + c.checksum gem_repo1, "rack", "0.9.1" + end + expect(lockfile).to eq <<~G PATH remote: #{lib_path("foo")} @@ -690,11 +697,7 @@ RSpec.describe "bundle install with explicit source paths" do DEPENDENCIES foo! - - CHECKSUMS - #{gem_no_checksum("foo", "1.0")} - #{checksum_for_repo_gem(gem_repo1, "rack", "0.9.1")} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} G @@ -722,11 +725,7 @@ RSpec.describe "bundle install with explicit source paths" do DEPENDENCIES foo! - - CHECKSUMS - #{gem_no_checksum("foo", "1.0")} - #{checksum_for_repo_gem(gem_repo1, "rack", "0.9.1")} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} G @@ -743,6 +742,11 @@ RSpec.describe "bundle install with explicit source paths" do expect(the_bundle).to include_gems "rack 0.9.1" + checksums = checksums_section_when_existing do |c| + c.no_checksum "foo", "1.0" + c.checksum gem_repo1, "rack", "0.9.1" + end + expect(lockfile).to eq <<~G PATH remote: #{lib_path("foo")} @@ -760,11 +764,7 @@ RSpec.describe "bundle install with explicit source paths" do DEPENDENCIES foo! - - CHECKSUMS - #{gem_no_checksum("foo", "1.0")} - #{checksum_for_repo_gem(gem_repo1, "rack", "0.9.1")} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} G @@ -776,6 +776,8 @@ RSpec.describe "bundle install with explicit source paths" do bundle "install" + checksums.checksum gem_repo1, "rake", "13.0.1" + expect(lockfile).to eq <<~G PATH remote: #{lib_path("foo")} @@ -795,12 +797,7 @@ RSpec.describe "bundle install with explicit source paths" do DEPENDENCIES foo! - - CHECKSUMS - #{gem_no_checksum("foo", "1.0")} - #{checksum_for_repo_gem(gem_repo1, "rack", "0.9.1")} - #{checksum_for_repo_gem(gem_repo1, "rake", "13.0.1")} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} G @@ -813,6 +810,10 @@ RSpec.describe "bundle install with explicit source paths" do s.add_dependency "rack", "0.9.1" end + checksums = checksums_section_when_existing do |c| + c.no_checksum "foo", "1.0" + end + lockfile <<~L PATH remote: #{lib_path("foo")} @@ -824,13 +825,15 @@ RSpec.describe "bundle install with explicit source paths" do DEPENDENCIES foo! - + #{checksums} BUNDLED WITH #{Bundler::VERSION} L bundle "lock" + checksums.no_checksum "rack", "0.9.1" + expect(lockfile).to eq <<~G PATH remote: #{lib_path("foo")} @@ -848,11 +851,7 @@ RSpec.describe "bundle install with explicit source paths" do DEPENDENCIES foo! - - CHECKSUMS - #{gem_no_checksum("foo", "1.0")} - #{gem_no_checksum("rack", "0.9.1")} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} G diff --git a/spec/bundler/install/gemfile/platform_spec.rb b/spec/bundler/install/gemfile/platform_spec.rb index 918a49e1e1..d4bbecfe04 100644 --- a/spec/bundler/install/gemfile/platform_spec.rb +++ b/spec/bundler/install/gemfile/platform_spec.rb @@ -203,6 +203,15 @@ RSpec.describe "bundle install across platforms" do gem "pry" G + checksums = checksums_section_when_existing do |c| + c.checksum gem_repo4, "coderay", "1.1.2" + c.checksum gem_repo4, "empyrean", "0.1.0" + c.checksum gem_repo4, "ffi", "1.9.23", "java" + c.checksum gem_repo4, "method_source", "0.9.0" + c.checksum gem_repo4, "pry", "0.11.3", "java" + c.checksum gem_repo4, "spoon", "0.0.6" + end + expect(lockfile).to eq <<~L GEM remote: #{file_uri_for(gem_repo4)}/ @@ -224,15 +233,7 @@ RSpec.describe "bundle install across platforms" do DEPENDENCIES empyrean (= 0.1.0) pry - - CHECKSUMS - #{checksum_for_repo_gem gem_repo4, "coderay", "1.1.2"} - #{checksum_for_repo_gem gem_repo4, "empyrean", "0.1.0"} - #{checksum_for_repo_gem gem_repo4, "ffi", "1.9.23", "java"} - #{checksum_for_repo_gem gem_repo4, "method_source", "0.9.0"} - #{checksum_for_repo_gem gem_repo4, "pry", "0.11.3", "java"} - #{checksum_for_repo_gem gem_repo4, "spoon", "0.0.6"} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} L @@ -264,16 +265,7 @@ RSpec.describe "bundle install across platforms" do DEPENDENCIES empyrean (= 0.1.0) pry - - CHECKSUMS - #{checksum_for_repo_gem gem_repo4, "coderay", "1.1.2"} - #{checksum_for_repo_gem gem_repo4, "empyrean", "0.1.0"} - #{checksum_for_repo_gem gem_repo4, "ffi", "1.9.23", "java"} - #{checksum_for_repo_gem gem_repo4, "method_source", "0.9.0"} - pry (0.11.3) - #{checksum_for_repo_gem gem_repo4, "pry", "0.11.3", "java"} - #{checksum_for_repo_gem gem_repo4, "spoon", "0.0.6"} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} L @@ -306,15 +298,7 @@ RSpec.describe "bundle install across platforms" do DEPENDENCIES empyrean (= 0.1.0) pry - - CHECKSUMS - #{checksum_for_repo_gem gem_repo4, "coderay", "1.1.2"} - #{checksum_for_repo_gem gem_repo4, "empyrean", "0.1.0"} - #{checksum_for_repo_gem gem_repo4, "ffi", "1.9.23", "java"} - #{checksum_for_repo_gem gem_repo4, "method_source", "0.9.0"} - #{checksum_for_repo_gem gem_repo4, "pry", "0.11.3", "java"} - #{checksum_for_repo_gem gem_repo4, "spoon", "0.0.6"} - + #{checksums} BUNDLED WITH 1.16.1 L @@ -388,6 +372,11 @@ RSpec.describe "bundle install across platforms" do end it "keeps existing platforms when installing with force_ruby_platform" do + checksums = checksums_section do |c| + c.no_checksum "platform_specific", "1.0" + c.no_checksum "platform_specific", "1.0", "java" + end + lockfile <<-G GEM remote: #{file_uri_for(gem_repo1)}/ @@ -399,6 +388,7 @@ RSpec.describe "bundle install across platforms" do DEPENDENCIES platform_specific + #{checksums} G bundle "config set --local force_ruby_platform true" @@ -408,6 +398,8 @@ RSpec.describe "bundle install across platforms" do gem "platform_specific" G + checksums.checksum gem_repo1, "platform_specific", "1.0" + expect(the_bundle).to include_gem "platform_specific 1.0 RUBY" expect(lockfile).to eq <<~G @@ -423,11 +415,7 @@ RSpec.describe "bundle install across platforms" do DEPENDENCIES platform_specific - - CHECKSUMS - #{checksum_for_repo_gem(gem_repo1, "platform_specific", "1.0")} - #{gem_no_checksum "platform_specific", "1.0", "java"} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} G @@ -596,9 +584,7 @@ RSpec.describe "bundle install with platform conditionals" do DEPENDENCIES rack - - CHECKSUMS - + #{checksums_section_when_existing} BUNDLED WITH #{Bundler::VERSION} L diff --git a/spec/bundler/install/gemfile/sources_spec.rb b/spec/bundler/install/gemfile/sources_spec.rb index bc6929ef73..7572fad90b 100644 --- a/spec/bundler/install/gemfile/sources_spec.rb +++ b/spec/bundler/install/gemfile/sources_spec.rb @@ -28,15 +28,32 @@ RSpec.describe "bundle install with gems on multiple sources" do end it "refuses to install mismatched checksum because one gem has been tampered with", :bundler => "< 3" do + lockfile <<~L + GEM + remote: https://gem.repo3/ + remote: https://gem.repo1/ + specs: + rack (1.0.0) + + PLATFORMS + #{local_platform} + + DEPENDENCIES + depends_on_rack! + + BUNDLED WITH + #{Bundler::VERSION} + L + bundle :install, :artifice => "compact_index", :raise_on_error => false expect(exitstatus).to eq(37) expect(err).to eq <<~E.strip [DEPRECATED] Your Gemfile contains multiple global sources. Using `source` more than once without a block is a security risk, and may result in installing unexpected gems. To resolve this warning, use a block to indicate which gems should come from the secondary source. Bundler found mismatched checksums. This is a potential security risk. - #{checksum_for_repo_gem(gem_repo1, "rack", "1.0.0")} + #{checksum_to_lock(gem_repo1, "rack", "1.0.0")} from the API at https://gem.repo1/ - #{checksum_for_repo_gem(gem_repo3, "rack", "1.0.0")} + #{checksum_to_lock(gem_repo3, "rack", "1.0.0")} from the API at https://gem.repo3/ Mismatched checksums each have an authoritative source: @@ -129,7 +146,7 @@ RSpec.describe "bundle install with gems on multiple sources" do end it "works in standalone mode", :bundler => "< 3" do - gem_checksum = checksum_for_repo_gem(gem_repo4, "foo", "1.0").split(Bundler::Checksum::ALGO_SEPARATOR).last + gem_checksum = checksum_digest(gem_repo4, "foo", "1.0") bundle "install --standalone", :artifice => "compact_index", :env => { "BUNDLER_SPEC_FOO_CHECKSUM" => gem_checksum } end end @@ -314,9 +331,9 @@ RSpec.describe "bundle install with gems on multiple sources" do expect(err).to eq(<<~E.strip) [DEPRECATED] Your Gemfile contains multiple global sources. Using `source` more than once without a block is a security risk, and may result in installing unexpected gems. To resolve this warning, use a block to indicate which gems should come from the secondary source. Bundler found mismatched checksums. This is a potential security risk. - #{checksum_for_repo_gem(gem_repo2, "rack", "1.0.0")} + #{checksum_to_lock(gem_repo2, "rack", "1.0.0")} from the API at https://gem.repo2/ - #{checksum_for_repo_gem(gem_repo1, "rack", "1.0.0")} + #{checksum_to_lock(gem_repo1, "rack", "1.0.0")} from the API at https://gem.repo1/ Mismatched checksums each have an authoritative source: @@ -340,7 +357,7 @@ RSpec.describe "bundle install with gems on multiple sources" do rack (1.0.0) sha256=#{rack_checksum} from the API at https://gem.repo2/ and the API at https://gem.repo1/ - #{checksum_for_repo_gem(gem_repo2, "rack", "1.0.0")} + #{checksum_to_lock(gem_repo2, "rack", "1.0.0")} from the gem at #{default_bundle_path("cache", "rack-1.0.0.gem")} If you trust the API at https://gem.repo2/, to resolve this issue you can: @@ -354,15 +371,15 @@ RSpec.describe "bundle install with gems on multiple sources" do end it "installs from the other source and warns about ambiguous gems when the sources have the same checksum", :bundler => "< 3" do - gem_checksum = checksum_for_repo_gem(gem_repo2, "rack", "1.0.0").split(Bundler::Checksum::ALGO_SEPARATOR).last + gem_checksum = checksum_digest(gem_repo2, "rack", "1.0.0") bundle :install, :artifice => "compact_index", :env => { "BUNDLER_SPEC_RACK_CHECKSUM" => gem_checksum, "DEBUG" => "1" } expect(err).to include("Warning: the gem 'rack' was found in multiple sources.") expect(err).to include("Installed from: https://gem.repo2") - expected_checksums = checksum_section do |c| - c.repo_gem gem_repo3, "depends_on_rack", "1.0.1" - c.repo_gem gem_repo2, "rack", "1.0.0" + checksums = checksums_section_when_existing do |c| + c.checksum gem_repo3, "depends_on_rack", "1.0.1" + c.checksum gem_repo2, "rack", "1.0.0" end expect(lockfile).to eq <<~L @@ -383,10 +400,7 @@ RSpec.describe "bundle install with gems on multiple sources" do DEPENDENCIES depends_on_rack! - - CHECKSUMS - #{expected_checksums} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} L @@ -403,7 +417,7 @@ RSpec.describe "bundle install with gems on multiple sources" do expect(err).to include("Warning: the gem 'rack' was found in multiple sources.") expect(err).to include("Installed from: https://gem.repo2") - expected_checksums = checksum_section do |c| + checksums = checksums_section_when_existing do |c| c.no_checksum "depends_on_rack", "1.0.1" c.no_checksum "rack", "1.0.0" end @@ -426,10 +440,7 @@ RSpec.describe "bundle install with gems on multiple sources" do DEPENDENCIES depends_on_rack! - - CHECKSUMS - #{expected_checksums} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} L @@ -772,6 +783,21 @@ RSpec.describe "bundle install with gems on multiple sources" do end G + @locked_checksums = checksums_section_when_existing do |c| + c.checksum gem_repo2, "activesupport", "6.0.3.4" + c.checksum gem_repo2, "concurrent-ruby", "1.1.8" + c.checksum gem_repo2, "connection_pool", "2.2.3" + c.checksum gem_repo2, "i18n", "1.8.9" + c.checksum gem_repo2, "minitest", "5.14.3" + c.checksum gem_repo2, "rack", "2.2.3" + c.checksum gem_repo2, "redis", "4.2.5" + c.checksum gem_repo2, "sidekiq", "6.1.3" + c.checksum gem_repo3, "sidekiq-pro", "5.2.1" + c.checksum gem_repo2, "thread_safe", "0.3.6" + c.checksum gem_repo2, "tzinfo", "1.2.9" + c.checksum gem_repo2, "zeitwerk", "2.4.2" + end + lockfile <<~L GEM remote: https://gem.repo2/ @@ -808,7 +834,7 @@ RSpec.describe "bundle install with gems on multiple sources" do DEPENDENCIES activesupport sidekiq-pro! - + #{@locked_checksums} BUNDLED WITH #{Bundler::VERSION} L @@ -825,21 +851,6 @@ RSpec.describe "bundle install with gems on multiple sources" do expect(the_bundle).to include_gems("concurrent-ruby 1.1.8") expect(the_bundle).not_to include_gems("concurrent-ruby 1.1.9") - expected_checksums = checksum_section do |c| - c.repo_gem gem_repo2, "activesupport", "6.0.3.4" - c.repo_gem gem_repo2, "concurrent-ruby", "1.1.8" - c.repo_gem gem_repo2, "connection_pool", "2.2.3" - c.repo_gem gem_repo2, "i18n", "1.8.9" - c.repo_gem gem_repo2, "minitest", "5.14.3" - c.repo_gem gem_repo2, "rack", "2.2.3" - c.repo_gem gem_repo2, "redis", "4.2.5" - c.repo_gem gem_repo2, "sidekiq", "6.1.3" - c.repo_gem gem_repo3, "sidekiq-pro", "5.2.1" - c.repo_gem gem_repo2, "thread_safe", "0.3.6" - c.repo_gem gem_repo2, "tzinfo", "1.2.9" - c.repo_gem gem_repo2, "zeitwerk", "2.4.2" - end - expect(lockfile).to eq <<~L GEM remote: https://gem.repo2/ @@ -879,10 +890,7 @@ RSpec.describe "bundle install with gems on multiple sources" do DEPENDENCIES activesupport sidekiq-pro! - - CHECKSUMS - #{expected_checksums} - + #{@locked_checksums} BUNDLED WITH #{Bundler::VERSION} L @@ -923,24 +931,16 @@ RSpec.describe "bundle install with gems on multiple sources" do expect(the_bundle).not_to include_gems("activesupport 6.0.3.4") expect(the_bundle).to include_gems("activesupport 6.1.2.1") + @locked_checksums.checksum gem_repo2, "activesupport", "6.1.2.1" + expect(the_bundle).not_to include_gems("tzinfo 1.2.9") expect(the_bundle).to include_gems("tzinfo 2.0.4") + @locked_checksums.checksum gem_repo2, "tzinfo", "2.0.4" + @locked_checksums.delete "thread_safe" + expect(the_bundle).not_to include_gems("concurrent-ruby 1.1.8") expect(the_bundle).to include_gems("concurrent-ruby 1.1.9") - - expected_checksums = checksum_section do |c| - c.repo_gem gem_repo2, "activesupport", "6.1.2.1" - c.repo_gem gem_repo2, "concurrent-ruby", "1.1.9" - c.repo_gem gem_repo2, "connection_pool", "2.2.3" - c.repo_gem gem_repo2, "i18n", "1.8.9" - c.repo_gem gem_repo2, "minitest", "5.14.3" - c.repo_gem gem_repo2, "rack", "2.2.3" - c.repo_gem gem_repo2, "redis", "4.2.5" - c.repo_gem gem_repo2, "sidekiq", "6.1.3" - c.repo_gem gem_repo3, "sidekiq-pro", "5.2.1" - c.repo_gem gem_repo2, "tzinfo", "2.0.4" - c.repo_gem gem_repo2, "zeitwerk", "2.4.2" - end + @locked_checksums.checksum gem_repo2, "concurrent-ruby", "1.1.9" expect(lockfile).to eq <<~L GEM @@ -980,10 +980,7 @@ RSpec.describe "bundle install with gems on multiple sources" do DEPENDENCIES activesupport sidekiq-pro! - - CHECKSUMS - #{expected_checksums} - + #{@locked_checksums} BUNDLED WITH #{Bundler::VERSION} L @@ -1000,20 +997,7 @@ RSpec.describe "bundle install with gems on multiple sources" do expect(the_bundle).to include_gems("concurrent-ruby 1.1.9") expect(the_bundle).not_to include_gems("concurrent-ruby 1.1.8") - expected_checksums = checksum_section do |c| - c.repo_gem gem_repo2, "activesupport", "6.0.3.4" - c.repo_gem gem_repo2, "concurrent-ruby", "1.1.9" - c.repo_gem gem_repo2, "connection_pool", "2.2.3" - c.repo_gem gem_repo2, "i18n", "1.8.9" - c.repo_gem gem_repo2, "minitest", "5.14.3" - c.repo_gem gem_repo2, "rack", "2.2.3" - c.repo_gem gem_repo2, "redis", "4.2.5" - c.repo_gem gem_repo2, "sidekiq", "6.1.3" - c.repo_gem gem_repo3, "sidekiq-pro", "5.2.1" - c.repo_gem gem_repo2, "thread_safe", "0.3.6" - c.repo_gem gem_repo2, "tzinfo", "1.2.9" - c.repo_gem gem_repo2, "zeitwerk", "2.4.2" - end + @locked_checksums.checksum gem_repo2, "concurrent-ruby", "1.1.9" expect(lockfile).to eq <<~L GEM @@ -1054,10 +1038,7 @@ RSpec.describe "bundle install with gems on multiple sources" do DEPENDENCIES activesupport sidekiq-pro! - - CHECKSUMS - #{expected_checksums} - + #{@locked_checksums} BUNDLED WITH #{Bundler::VERSION} L @@ -1125,10 +1106,10 @@ RSpec.describe "bundle install with gems on multiple sources" do end it "installs from the default source without any warnings or errors and generates a proper lockfile" do - expected_checksums = checksum_section do |c| - c.repo_gem gem_repo3, "handsoap", "0.2.5.5" - c.repo_gem gem_repo2, "nokogiri", "1.11.1" - c.repo_gem gem_repo2, "racca", "1.5.2" + checksums = checksums_section_when_existing do |c| + c.checksum gem_repo3, "handsoap", "0.2.5.5" + c.checksum gem_repo2, "nokogiri", "1.11.1" + c.checksum gem_repo2, "racca", "1.5.2" end expected_lockfile = <<~L @@ -1151,10 +1132,7 @@ RSpec.describe "bundle install with gems on multiple sources" do DEPENDENCIES handsoap! nokogiri - - CHECKSUMS - #{expected_checksums} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} L @@ -1243,7 +1221,7 @@ RSpec.describe "bundle install with gems on multiple sources" do DEPENDENCIES rack! - + #{checksums_section} BUNDLED WITH #{Bundler::VERSION} L @@ -1302,8 +1280,8 @@ RSpec.describe "bundle install with gems on multiple sources" do bundle "install", :artifice => "compact_index", :raise_on_error => false - api_checksum1 = checksum_for_repo_gem(gem_repo1, "rack", "0.9.1").split("sha256=").last - api_checksum3 = checksum_for_repo_gem(gem_repo3, "rack", "0.9.1").split("sha256=").last + api_checksum1 = checksum_digest(gem_repo1, "rack", "0.9.1") + api_checksum3 = checksum_digest(gem_repo3, "rack", "0.9.1") expect(exitstatus).to eq(37) expect(err).to eq(<<~E.strip) @@ -1712,9 +1690,9 @@ RSpec.describe "bundle install with gems on multiple sources" do it "upgrades the lockfile correctly" do bundle "lock --update", :artifice => "compact_index" - expected_checksums = checksum_section do |c| - c.repo_gem gem_repo2, "capybara", "2.5.0" - c.repo_gem gem_repo4, "mime-types", "3.0.0" + checksums = checksums_section_when_existing do |c| + c.checksum gem_repo2, "capybara", "2.5.0" + c.checksum gem_repo4, "mime-types", "3.0.0" end expect(lockfile).to eq <<~L @@ -1735,10 +1713,7 @@ RSpec.describe "bundle install with gems on multiple sources" do DEPENDENCIES capybara (~> 2.5.0) mime-types (~> 3.0)! - - CHECKSUMS - #{expected_checksums} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} L @@ -1774,6 +1749,11 @@ RSpec.describe "bundle install with gems on multiple sources" do it "handles that fine" do bundle "install", :artifice => "compact_index_extra", :env => { "BUNDLER_SPEC_GEM_REPO" => gem_repo4.to_s } + checksums = checksums_section_when_existing do |c| + c.checksum gem_repo4, "pdf-writer", "1.1.8" + c.checksum gem_repo2, "ruport", "1.7.0.3" + end + expect(lockfile).to eq <<~L GEM remote: https://localgemserver.test/ @@ -1791,11 +1771,7 @@ RSpec.describe "bundle install with gems on multiple sources" do DEPENDENCIES ruport (= 1.7.0.3)! - - CHECKSUMS - #{checksum_for_repo_gem gem_repo4, "pdf-writer", "1.1.8"} - #{checksum_for_repo_gem gem_repo2, "ruport", "1.7.0.3"} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} L @@ -1831,9 +1807,9 @@ RSpec.describe "bundle install with gems on multiple sources" do it "handles that fine" do bundle "install", :artifice => "compact_index_extra", :env => { "BUNDLER_SPEC_GEM_REPO" => gem_repo4.to_s } - expected_checksums = checksum_section do |c| - c.repo_gem gem_repo4, "pdf-writer", "1.1.8" - c.repo_gem gem_repo2, "ruport", "1.7.0.3" + checksums = checksums_section_when_existing do |c| + c.checksum gem_repo4, "pdf-writer", "1.1.8" + c.checksum gem_repo2, "ruport", "1.7.0.3" end expect(lockfile).to eq <<~L @@ -1853,10 +1829,7 @@ RSpec.describe "bundle install with gems on multiple sources" do DEPENDENCIES ruport (= 1.7.0.3)! - - CHECKSUMS - #{expected_checksums} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} L @@ -1886,8 +1859,8 @@ RSpec.describe "bundle install with gems on multiple sources" do it "handles that fine" do bundle "install --verbose", :artifice => "endpoint", :env => { "BUNDLER_SPEC_GEM_REPO" => gem_repo4.to_s } - expected_checksums = checksum_section do |c| - c.repo_gem gem_repo4, "pdf-writer", "1.1.8" + checksums = checksums_section_when_existing do |c| + c.checksum gem_repo4, "pdf-writer", "1.1.8" end expect(lockfile).to eq <<~L @@ -1901,10 +1874,7 @@ RSpec.describe "bundle install with gems on multiple sources" do DEPENDENCIES pdf-writer (= 1.1.8) - - CHECKSUMS - #{expected_checksums} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} L diff --git a/spec/bundler/install/gemfile/specific_platform_spec.rb b/spec/bundler/install/gemfile/specific_platform_spec.rb index 7089a94a66..131426b443 100644 --- a/spec/bundler/install/gemfile/specific_platform_spec.rb +++ b/spec/bundler/install/gemfile/specific_platform_spec.rb @@ -66,6 +66,10 @@ RSpec.describe "bundle install with specific platforms" do gemfile google_protobuf + checksums = checksums_section_when_existing do |c| + c.checksum gem_repo2, "google-protobuf", "3.0.0.alpha.4.0" + end + # simulate lockfile created with old bundler, which only locks for ruby platform lockfile <<-L GEM @@ -78,16 +82,15 @@ RSpec.describe "bundle install with specific platforms" do DEPENDENCIES google-protobuf - - CHECKSUMS - google-protobuf (3.0.0.alpha.4.0) - + #{checksums} BUNDLED WITH 2.1.4 L bundle "update", :env => { "BUNDLER_VERSION" => Bundler::VERSION } + checksums.checksum gem_repo2, "google-protobuf", "3.0.0.alpha.5.0.5.1" + # make sure the platform that the platform specific dependency is used, since we're only locked to ruby expect(the_bundle).to include_gem("google-protobuf 3.0.0.alpha.5.0.5.1 universal-darwin") @@ -103,10 +106,7 @@ RSpec.describe "bundle install with specific platforms" do DEPENDENCIES google-protobuf - - CHECKSUMS - google-protobuf (3.0.0.alpha.5.0.5.1) - + #{checksums} BUNDLED WITH #{Bundler::VERSION} L @@ -528,11 +528,11 @@ RSpec.describe "bundle install with specific platforms" do bundle "update" - expected_checksums = checksum_section do |c| - c.repo_gem gem_repo4, "sorbet", "0.5.10160" - c.repo_gem gem_repo4, "sorbet-runtime", "0.5.10160" - c.repo_gem gem_repo4, "sorbet-static", "0.5.10160", Gem::Platform.local - c.repo_gem gem_repo4, "sorbet-static-and-runtime", "0.5.10160" + checksums = checksums_section_when_existing do |c| + c.checksum gem_repo4, "sorbet", "0.5.10160" + c.checksum gem_repo4, "sorbet-runtime", "0.5.10160" + c.checksum gem_repo4, "sorbet-static", "0.5.10160", Gem::Platform.local + c.checksum gem_repo4, "sorbet-static-and-runtime", "0.5.10160" end expect(lockfile).to eq <<~L @@ -552,10 +552,7 @@ RSpec.describe "bundle install with specific platforms" do DEPENDENCIES sorbet-static-and-runtime - - CHECKSUMS - #{expected_checksums} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} L @@ -587,6 +584,11 @@ RSpec.describe "bundle install with specific platforms" do G end + checksums = checksums_section_when_existing do |c| + c.no_checksum "nokogiri", "1.13.0", "x86_64-darwin" + c.no_checksum "sorbet-static", "0.5.10601", "x86_64-darwin" + end + lockfile <<~L GEM remote: #{file_uri_for(gem_repo4)}/ @@ -602,7 +604,7 @@ RSpec.describe "bundle install with specific platforms" do DEPENDENCIES nokogiri sorbet-static - + #{checksums} BUNDLED WITH #{Bundler::VERSION} L @@ -624,11 +626,7 @@ RSpec.describe "bundle install with specific platforms" do DEPENDENCIES nokogiri sorbet-static - - CHECKSUMS - #{gem_no_checksum "nokogiri", "1.13.0", "x86_64-darwin"} - #{gem_no_checksum "sorbet-static", "0.5.10601", "x86_64-darwin"} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} L @@ -682,11 +680,11 @@ RSpec.describe "bundle install with specific platforms" do bundle "update" - expected_checksums = checksum_section do |c| - c.repo_gem gem_repo4, "sorbet", "0.5.10160" - c.repo_gem gem_repo4, "sorbet-runtime", "0.5.10160" - c.repo_gem gem_repo4, "sorbet-static", "0.5.10160", Gem::Platform.local - c.repo_gem gem_repo4, "sorbet-static-and-runtime", "0.5.10160" + checksums = checksums_section_when_existing do |c| + c.checksum gem_repo4, "sorbet", "0.5.10160" + c.checksum gem_repo4, "sorbet-runtime", "0.5.10160" + c.checksum gem_repo4, "sorbet-static", "0.5.10160", Gem::Platform.local + c.checksum gem_repo4, "sorbet-static-and-runtime", "0.5.10160" end expect(lockfile).to eq <<~L @@ -706,10 +704,7 @@ RSpec.describe "bundle install with specific platforms" do DEPENDENCIES sorbet-static-and-runtime - - CHECKSUMS - #{expected_checksums} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} L @@ -760,9 +755,9 @@ RSpec.describe "bundle install with specific platforms" do bundle "update" - expected_checksums = checksum_section do |c| - c.repo_gem gem_repo4, "nokogiri", "1.14.0", "x86_64-linux" - c.repo_gem gem_repo4, "sorbet-static", "0.5.10696", "x86_64-linux" + checksums = checksums_section_when_existing do |c| + c.checksum gem_repo4, "nokogiri", "1.14.0", "x86_64-linux" + c.checksum gem_repo4, "sorbet-static", "0.5.10696", "x86_64-linux" end expect(lockfile).to eq <<~L @@ -778,10 +773,7 @@ RSpec.describe "bundle install with specific platforms" do DEPENDENCIES nokogiri sorbet-static - - CHECKSUMS - #{expected_checksums} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} L @@ -807,6 +799,11 @@ RSpec.describe "bundle install with specific platforms" do gem "sorbet-static", "= 0.5.10549" G + checksums = checksums_section_when_existing do |c| + c.checksum gem_repo4, "sorbet-static", "0.5.10549", "universal-darwin-20" + c.checksum gem_repo4, "sorbet-static", "0.5.10549", "universal-darwin-21" + end + # Make sure the lockfile is missing sorbet-static-0.5.10549-universal-darwin-21 lockfile <<~L GEM @@ -819,17 +816,15 @@ RSpec.describe "bundle install with specific platforms" do DEPENDENCIES sorbet-static (= 0.5.10549) - - CHECKSUMS - #{checksum_for_repo_gem gem_repo4, "sorbet-static", "0.5.10549", "universal-darwin-20"} - #{checksum_for_repo_gem gem_repo4, "sorbet-static", "0.5.10549", "universal-darwin-21"} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} L bundle "install" + checksums.no_checksum "sorbet-static", "0.5.10549", "universal-darwin-21" + expect(lockfile).to eq <<~L GEM remote: #{file_uri_for(gem_repo4)}/ @@ -842,11 +837,7 @@ RSpec.describe "bundle install with specific platforms" do DEPENDENCIES sorbet-static (= 0.5.10549) - - CHECKSUMS - #{checksum_for_repo_gem gem_repo4, "sorbet-static", "0.5.10549", "universal-darwin-20"} - #{gem_no_checksum "sorbet-static", "0.5.10549", "universal-darwin-21"} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} L @@ -893,6 +884,11 @@ RSpec.describe "bundle install with specific platforms" do bundle "lock --update" + checksums = checksums_section_when_existing do |c| + c.no_checksum "nokogiri", "1.13.8" + c.no_checksum "nokogiri", "1.13.8", Gem::Platform.local + end + updated_lockfile = <<~L GEM remote: #{file_uri_for(gem_repo4)}/ @@ -906,11 +902,7 @@ RSpec.describe "bundle install with specific platforms" do DEPENDENCIES nokogiri tzinfo (~> 1.2) - - CHECKSUMS - #{gem_no_checksum "nokogiri", "1.13.8"} - #{gem_no_checksum "nokogiri", "1.13.8", Gem::Platform.local} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} L @@ -931,6 +923,11 @@ RSpec.describe "bundle install with specific platforms" do gem "rack" G + checksums = checksums_section_when_existing do |c| + c.no_checksum "concurrent-ruby", "1.2.2" + c.no_checksum "rack", "3.0.7" + end + lockfile <<~L GEM remote: #{file_uri_for(gem_repo4)}/ @@ -942,7 +939,7 @@ RSpec.describe "bundle install with specific platforms" do DEPENDENCIES concurrent-ruby - + #{checksums} BUNDLED WITH #{Bundler::VERSION} L @@ -962,11 +959,7 @@ RSpec.describe "bundle install with specific platforms" do DEPENDENCIES concurrent-ruby rack - - CHECKSUMS - #{gem_no_checksum "concurrent-ruby", "1.2.2"} - #{gem_no_checksum "rack", "3.0.7"} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} L @@ -1029,6 +1022,10 @@ RSpec.describe "bundle install with specific platforms" do gem "nokogiri", "1.14.0" G + checksums = checksums_section_when_existing do |c| + c.checksum gem_repo4, "nokogiri", "1.14.0", "x86_64-linux" + end + lockfile <<~L GEM remote: #{file_uri_for(gem_repo4)}/ @@ -1040,13 +1037,17 @@ RSpec.describe "bundle install with specific platforms" do DEPENDENCIES nokogiri (= 1.14.0) - + #{checksums} BUNDLED WITH #{Bundler::VERSION} L bundle :install + checksums = checksums_section_when_existing do |c| + c.checksum gem_repo4, "nokogiri", "1.14.0" + end + expect(lockfile).to eq(<<~L) GEM remote: #{file_uri_for(gem_repo4)}/ @@ -1058,10 +1059,7 @@ RSpec.describe "bundle install with specific platforms" do DEPENDENCIES nokogiri (= 1.14.0) - - CHECKSUMS - #{checksum_for_repo_gem gem_repo4, "nokogiri", "1.14.0"} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} L @@ -1101,6 +1099,12 @@ RSpec.describe "bundle install with specific platforms" do bundle "lock" + checksums = checksums_section_when_existing do |c| + c.no_checksum "nokogiri", "1.14.0" + c.no_checksum "nokogiri", "1.14.0", "arm-linux" + c.no_checksum "nokogiri", "1.14.0", "x86_64-linux" + end + # locks all compatible platforms, excluding Java and Windows expect(lockfile).to eq(<<~L) GEM @@ -1117,12 +1121,7 @@ RSpec.describe "bundle install with specific platforms" do DEPENDENCIES nokogiri - - CHECKSUMS - #{gem_no_checksum "nokogiri", "1.14.0"} - #{gem_no_checksum "nokogiri", "1.14.0", "arm-linux"} - #{gem_no_checksum "nokogiri", "1.14.0", "x86_64-linux"} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} L @@ -1138,6 +1137,10 @@ RSpec.describe "bundle install with specific platforms" do bundle "lock" + checksums.delete "nokogiri", "arm-linux" + checksums.no_checksum "sorbet-static", "0.5.10696", "universal-darwin-22" + checksums.no_checksum "sorbet-static", "0.5.10696", "x86_64-linux" + # locks only platforms compatible with all gems in the bundle expect(lockfile).to eq(<<~L) GEM @@ -1155,13 +1158,7 @@ RSpec.describe "bundle install with specific platforms" do DEPENDENCIES nokogiri sorbet-static - - CHECKSUMS - #{gem_no_checksum "nokogiri", "1.14.0"} - #{gem_no_checksum "nokogiri", "1.14.0", "x86_64-linux"} - #{gem_no_checksum "sorbet-static", "0.5.10696", "universal-darwin-22"} - #{gem_no_checksum "sorbet-static", "0.5.10696", "x86_64-linux"} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} L @@ -1191,10 +1188,10 @@ RSpec.describe "bundle install with specific platforms" do gem "sass-embedded" G - expected_checksums = checksum_section do |c| - c.repo_gem gem_repo4, "nokogiri", "1.15.5" + checksums = checksums_section_when_existing do |c| + c.checksum gem_repo4, "nokogiri", "1.15.5" c.no_checksum "sass-embedded", "1.69.5" - c.repo_gem gem_repo4, "sass-embedded", "1.69.5", "x86_64-linux-gnu" + c.checksum gem_repo4, "sass-embedded", "1.69.5", "x86_64-linux-gnu" end simulate_platform "x86_64-linux" do @@ -1216,10 +1213,7 @@ RSpec.describe "bundle install with specific platforms" do DEPENDENCIES nokogiri sass-embedded - - CHECKSUMS - #{expected_checksums} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} L diff --git a/spec/bundler/install/gems/compact_index_spec.rb b/spec/bundler/install/gems/compact_index_spec.rb index b383614410..ea21e66987 100644 --- a/spec/bundler/install/gems/compact_index_spec.rb +++ b/spec/bundler/install/gems/compact_index_spec.rb @@ -961,8 +961,25 @@ RSpec.describe "compact index api" do end describe "checksum validation" do + before do + lockfile <<-L + GEM + remote: #{source_uri} + specs: + rack (1.0.0) + + PLATFORMS + ruby + + DEPENDENCIES + #{checksums_section} + BUNDLED WITH + #{Bundler::VERSION} + L + end + it "handles checksums from the server in base64" do - api_checksum = checksum_for_repo_gem(gem_repo1, "rack", "1.0.0").split("sha256=").last + api_checksum = checksum_digest(gem_repo1, "rack", "1.0.0") rack_checksum = [[api_checksum].pack("H*")].pack("m0") install_gemfile <<-G, :artifice => "compact_index", :env => { "BUNDLER_SPEC_RACK_CHECKSUM" => rack_checksum } source "#{source_uri}" @@ -979,8 +996,6 @@ RSpec.describe "compact index api" do gem "rack" G - api_checksum = checksum_for_repo_gem(gem_repo1, "rack", "1.0.0").split("sha256=").last - gem_path = if Bundler.feature_flag.global_gem_cache? default_cache_path.dirname.join("cache", "gems", "localgemserver.test.80.dd34752a738ee965a2a4298dc16db6c5", "rack-1.0.0.gem") else @@ -992,7 +1007,7 @@ RSpec.describe "compact index api" do Bundler found mismatched checksums. This is a potential security risk. rack (1.0.0) sha256=2222222222222222222222222222222222222222222222222222222222222222 from the API at http://localgemserver.test/ - rack (1.0.0) sha256=#{api_checksum} + #{checksum_to_lock(gem_repo1, "rack", "1.0.0")} from the gem at #{gem_path} If you trust the API at http://localgemserver.test/, to resolve this issue you can: @@ -1057,6 +1072,7 @@ Running `bundle update rails` should fix the problem. G gem_command "uninstall activemerchant" bundle "update rails", :artifice => "compact_index" - expect(lockfile.scan(/activemerchant \(/).size).to eq(2) # Once in the specs, and once in CHECKSUMS + count = lockfile.match?("CHECKSUMS") ? 2 : 1 # Once in the specs, and once in CHECKSUMS + expect(lockfile.scan(/activemerchant \(/).size).to eq(count) end end diff --git a/spec/bundler/install/gems/flex_spec.rb b/spec/bundler/install/gems/flex_spec.rb index 484ec1f839..01222cbbc4 100644 --- a/spec/bundler/install/gems/flex_spec.rb +++ b/spec/bundler/install/gems/flex_spec.rb @@ -268,6 +268,11 @@ RSpec.describe "bundle flex_install" do it "should work when you install" do bundle "install" + checksums = checksums_section_when_existing do |c| + c.checksum gem_repo1, "rack", "0.9.1" + c.checksum gem_repo1, "rack-obama", "1.0" + end + expect(lockfile).to eq <<~L GEM remote: #{file_uri_for(gem_repo1)}/ @@ -282,11 +287,7 @@ RSpec.describe "bundle flex_install" do DEPENDENCIES rack (= 0.9.1) rack-obama - - CHECKSUMS - #{checksum_for_repo_gem gem_repo1, "rack", "0.9.1"} - #{checksum_for_repo_gem gem_repo1, "rack-obama", "1.0"} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} L @@ -312,6 +313,10 @@ RSpec.describe "bundle flex_install" do gem "rack" G + checksums = checksums_section_when_existing do |c| + c.checksum gem_repo1, "rack", "1.0.0" + end + expect(lockfile).to eq <<~L GEM remote: #{file_uri_for(gem_repo1)}/ @@ -327,10 +332,7 @@ RSpec.describe "bundle flex_install" do DEPENDENCIES rack - - CHECKSUMS - #{checksum_for_repo_gem gem_repo1, "rack", "1.0.0"} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} L diff --git a/spec/bundler/install/gems/resolving_spec.rb b/spec/bundler/install/gems/resolving_spec.rb index b9f928a0db..8c9ec61ed0 100644 --- a/spec/bundler/install/gems/resolving_spec.rb +++ b/spec/bundler/install/gems/resolving_spec.rb @@ -256,6 +256,10 @@ RSpec.describe "bundle install with install-time dependencies" do gem 'parallel_tests' G + checksums = checksums_section do |c| + c.checksum gem_repo2, "parallel_tests", "3.8.0" + end + lockfile <<~L GEM remote: http://localgemserver.test/ @@ -267,7 +271,7 @@ RSpec.describe "bundle install with install-time dependencies" do DEPENDENCIES parallel_tests - + #{checksums} BUNDLED WITH #{Bundler::VERSION} L @@ -276,6 +280,10 @@ RSpec.describe "bundle install with install-time dependencies" do it "automatically updates lockfile to use the older version" do bundle "install --verbose", :artifice => "compact_index", :env => { "BUNDLER_SPEC_GEM_REPO" => gem_repo2.to_s } + checksums = checksums_section_when_existing do |c| + c.checksum gem_repo2, "parallel_tests", "3.7.0" + end + expect(lockfile).to eq <<~L GEM remote: http://localgemserver.test/ @@ -287,10 +295,7 @@ RSpec.describe "bundle install with install-time dependencies" do DEPENDENCIES parallel_tests - - CHECKSUMS - #{checksum_for_repo_gem gem_repo2, "parallel_tests", "3.7.0"} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} L @@ -335,6 +340,11 @@ RSpec.describe "bundle install with install-time dependencies" do gem 'rubocop' G + checksums = checksums_section do |c| + c.checksum gem_repo2, "rubocop", "1.35.0" + c.checksum gem_repo2, "rubocop-ast", "1.21.0" + end + lockfile <<~L GEM remote: http://localgemserver.test/ @@ -348,7 +358,7 @@ RSpec.describe "bundle install with install-time dependencies" do DEPENDENCIES parallel_tests - + #{checksums} BUNDLED WITH #{Bundler::VERSION} L @@ -357,6 +367,11 @@ RSpec.describe "bundle install with install-time dependencies" do it "automatically updates lockfile to use the older compatible versions" do bundle "install --verbose", :artifice => "compact_index", :env => { "BUNDLER_SPEC_GEM_REPO" => gem_repo2.to_s } + checksums = checksums_section_when_existing do |c| + c.checksum gem_repo2, "rubocop", "1.28.2" + c.checksum gem_repo2, "rubocop-ast", "1.17.0" + end + expect(lockfile).to eq <<~L GEM remote: http://localgemserver.test/ @@ -370,11 +385,7 @@ RSpec.describe "bundle install with install-time dependencies" do DEPENDENCIES rubocop - - CHECKSUMS - #{checksum_for_repo_gem gem_repo2, "rubocop", "1.28.2"} - #{checksum_for_repo_gem gem_repo2, "rubocop-ast", "1.17.0"} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} L diff --git a/spec/bundler/install/yanked_spec.rb b/spec/bundler/install/yanked_spec.rb index 338a187472..dc054b50bb 100644 --- a/spec/bundler/install/yanked_spec.rb +++ b/spec/bundler/install/yanked_spec.rb @@ -160,10 +160,6 @@ RSpec.context "when resolving a bundle that includes yanked gems, but unlocking bar foo - CHECKSUMS - #{gem_no_checksum "bar", "2.0.0"} - #{gem_no_checksum "foo", "9.0.0"} - BUNDLED WITH #{Bundler::VERSION} L diff --git a/spec/bundler/lock/lockfile_spec.rb b/spec/bundler/lock/lockfile_spec.rb index 455315dab7..f32b039906 100644 --- a/spec/bundler/lock/lockfile_spec.rb +++ b/spec/bundler/lock/lockfile_spec.rb @@ -6,6 +6,10 @@ RSpec.describe "the lockfile format" do end it "generates a simple lockfile for a single source, gem" do + checksums = checksums_section_when_existing do |c| + c.checksum(gem_repo2, "rack", "1.0.0") + end + install_gemfile <<-G source "#{file_uri_for(gem_repo2)}" @@ -23,10 +27,7 @@ RSpec.describe "the lockfile format" do DEPENDENCIES rack - - CHECKSUMS - #{checksum_for_repo_gem(gem_repo2, "rack", "1.0.0")} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} G @@ -78,9 +79,6 @@ RSpec.describe "the lockfile format" do DEPENDENCIES rack - CHECKSUMS - #{checksum_for_repo_gem(gem_repo2, "rack", "1.0.0")} - BUNDLED WITH #{Bundler::VERSION} G @@ -134,6 +132,10 @@ RSpec.describe "the lockfile format" do it "does not update the lockfile's bundler version if nothing changed during bundle install, and uses the latest version", :rubygems => "< 3.3.0.a" do version = "#{Bundler::VERSION.split(".").first}.0.0.a" + checksums = checksums_section do |c| + c.checksum(gem_repo2, "rack", "1.0.0") + end + lockfile <<-L GEM remote: #{file_uri_for(gem_repo2)}/ @@ -145,10 +147,7 @@ RSpec.describe "the lockfile format" do DEPENDENCIES rack - - CHECKSUMS - #{checksum_for_repo_gem(gem_repo2, "rack", "1.0.0")} - + #{checksums} BUNDLED WITH #{version} L @@ -173,10 +172,7 @@ RSpec.describe "the lockfile format" do DEPENDENCIES rack - - CHECKSUMS - #{checksum_for_repo_gem(gem_repo2, "rack", "1.0.0")} - + #{checksums} BUNDLED WITH #{version} G @@ -214,9 +210,6 @@ RSpec.describe "the lockfile format" do DEPENDENCIES rack (> 0) - CHECKSUMS - #{checksum_for_repo_gem(gem_repo2, "rack", "1.0.0")} - BUNDLED WITH #{Bundler::VERSION} G @@ -264,9 +257,6 @@ RSpec.describe "the lockfile format" do DEPENDENCIES rack - CHECKSUMS - #{checksum_for_repo_gem(gem_repo2, "rack", "1.0.0")} - BUNDLED WITH #{current_version} G @@ -279,9 +269,9 @@ RSpec.describe "the lockfile format" do gem "rack-obama" G - expected_checksums = checksum_section do |c| - c.repo_gem gem_repo2, "rack", "1.0.0" - c.repo_gem gem_repo2, "rack-obama", "1.0" + checksums = checksums_section_when_existing do |c| + c.checksum gem_repo2, "rack", "1.0.0" + c.checksum gem_repo2, "rack-obama", "1.0" end expect(lockfile).to eq <<~G @@ -297,10 +287,7 @@ RSpec.describe "the lockfile format" do DEPENDENCIES rack-obama - - CHECKSUMS - #{expected_checksums} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} G @@ -313,9 +300,9 @@ RSpec.describe "the lockfile format" do gem "rack-obama", ">= 1.0" G - expected_checksums = checksum_section do |c| - c.repo_gem gem_repo2, "rack", "1.0.0" - c.repo_gem gem_repo2, "rack-obama", "1.0" + checksums = checksums_section_when_existing do |c| + c.checksum gem_repo2, "rack", "1.0.0" + c.checksum gem_repo2, "rack-obama", "1.0" end expect(lockfile).to eq <<~G @@ -331,10 +318,7 @@ RSpec.describe "the lockfile format" do DEPENDENCIES rack-obama (>= 1.0) - - CHECKSUMS - #{expected_checksums} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} G @@ -355,9 +339,9 @@ RSpec.describe "the lockfile format" do end G - expected_checksums = checksum_section do |c| - c.repo_gem gem_repo2, "rack", "1.0.0" - c.repo_gem gem_repo2, "rack-obama", "1.0" + checksums = checksums_section_when_existing do |c| + c.checksum gem_repo2, "rack", "1.0.0" + c.checksum gem_repo2, "rack-obama", "1.0" end expect(lockfile).to eq <<~G @@ -381,10 +365,7 @@ RSpec.describe "the lockfile format" do DEPENDENCIES rack-obama (>= 1.0)! - - CHECKSUMS - #{expected_checksums} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} G @@ -396,9 +377,9 @@ RSpec.describe "the lockfile format" do gem "net-sftp" G - expected_checksums = checksum_section do |c| - c.repo_gem gem_repo2, "net-sftp", "1.1.1" - c.repo_gem gem_repo2, "net-ssh", "1.0" + checksums = checksums_section_when_existing do |c| + c.checksum gem_repo2, "net-sftp", "1.1.1" + c.checksum gem_repo2, "net-ssh", "1.0" end expect(lockfile).to eq <<~G @@ -414,10 +395,7 @@ RSpec.describe "the lockfile format" do DEPENDENCIES net-sftp - - CHECKSUMS - #{expected_checksums} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} G @@ -433,6 +411,10 @@ RSpec.describe "the lockfile format" do gem "foo", :git => "#{lib_path("foo-1.0")}" G + checksums = checksums_section_when_existing do |c| + c.no_checksum "foo", "1.0" + end + expect(lockfile).to eq <<~G GIT remote: #{lib_path("foo-1.0")} @@ -449,10 +431,7 @@ RSpec.describe "the lockfile format" do DEPENDENCIES foo! - - CHECKSUMS - foo (1.0) - + #{checksums} BUNDLED WITH #{Bundler::VERSION} G @@ -500,6 +479,10 @@ RSpec.describe "the lockfile format" do it "serializes global git sources" do git = build_git "foo" + checksums = checksums_section_when_existing do |c| + c.no_checksum "foo", "1.0" + end + install_gemfile <<-G source "#{file_uri_for(gem_repo1)}" git "#{lib_path("foo-1.0")}" do @@ -523,10 +506,7 @@ RSpec.describe "the lockfile format" do DEPENDENCIES foo! - - CHECKSUMS - foo (1.0) - + #{checksums} BUNDLED WITH #{Bundler::VERSION} G @@ -536,6 +516,10 @@ RSpec.describe "the lockfile format" do git = build_git "foo" update_git "foo", :branch => "omg" + checksums = checksums_section_when_existing do |c| + c.no_checksum "foo", "1.0" + end + install_gemfile <<-G source "#{file_uri_for(gem_repo1)}" gem "foo", :git => "#{lib_path("foo-1.0")}", :branch => "omg" @@ -558,10 +542,7 @@ RSpec.describe "the lockfile format" do DEPENDENCIES foo! - - CHECKSUMS - foo (1.0) - + #{checksums} BUNDLED WITH #{Bundler::VERSION} G @@ -571,6 +552,10 @@ RSpec.describe "the lockfile format" do git = build_git "foo" update_git "foo", :tag => "omg" + checksums = checksums_section_when_existing do |c| + c.no_checksum "foo", "1.0" + end + install_gemfile <<-G source "#{file_uri_for(gem_repo1)}" gem "foo", :git => "#{lib_path("foo-1.0")}", :tag => "omg" @@ -593,10 +578,7 @@ RSpec.describe "the lockfile format" do DEPENDENCIES foo! - - CHECKSUMS - foo (1.0) - + #{checksums} BUNDLED WITH #{Bundler::VERSION} G @@ -683,10 +665,6 @@ RSpec.describe "the lockfile format" do DEPENDENCIES ckeditor! - CHECKSUMS - #{gem_no_checksum "ckeditor", "4.0.8"} - #{gem_no_checksum "orm_adapter", "0.4.1"} - BUNDLED WITH #{Bundler::VERSION} L @@ -695,6 +673,10 @@ RSpec.describe "the lockfile format" do it "serializes pinned path sources to the lockfile" do build_lib "foo" + checksums = checksums_section_when_existing do |c| + c.no_checksum "foo", "1.0" + end + install_gemfile <<-G source "#{file_uri_for(gem_repo1)}" gem "foo", :path => "#{lib_path("foo-1.0")}" @@ -715,10 +697,7 @@ RSpec.describe "the lockfile format" do DEPENDENCIES foo! - - CHECKSUMS - foo (1.0) - + #{checksums} BUNDLED WITH #{Bundler::VERSION} G @@ -727,6 +706,10 @@ RSpec.describe "the lockfile format" do it "serializes pinned path sources to the lockfile even when packaging" do build_lib "foo" + checksums = checksums_section_when_existing do |c| + c.no_checksum "foo", "1.0" + end + install_gemfile <<-G source "#{file_uri_for(gem_repo1)}" gem "foo", :path => "#{lib_path("foo-1.0")}" @@ -751,10 +734,7 @@ RSpec.describe "the lockfile format" do DEPENDENCIES foo! - - CHECKSUMS - foo (1.0) - + #{checksums} BUNDLED WITH #{Bundler::VERSION} G @@ -764,6 +744,12 @@ RSpec.describe "the lockfile format" do build_lib "foo" bar = build_git "bar" + checksums = checksums_section_when_existing do |c| + c.no_checksum "foo", "1.0" + c.no_checksum "bar", "1.0" + c.checksum gem_repo2, "rack", "1.0.0" + end + install_gemfile <<-G source "#{file_uri_for(gem_repo2)}/" @@ -796,12 +782,7 @@ RSpec.describe "the lockfile format" do bar! foo! rack - - CHECKSUMS - bar (1.0) - foo (1.0) - #{checksum_for_repo_gem gem_repo2, "rack", "1.0.0"} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} G @@ -814,8 +795,8 @@ RSpec.describe "the lockfile format" do gem "rack", :source => "#{file_uri_for(gem_repo2)}/" G - expected_checksums = checksum_section do |c| - c.repo_gem gem_repo2, "rack", "1.0.0" + checksums = checksums_section_when_existing do |c| + c.checksum gem_repo2, "rack", "1.0.0" end expect(lockfile).to eq <<~G @@ -829,10 +810,7 @@ RSpec.describe "the lockfile format" do DEPENDENCIES rack! - - CHECKSUMS - #{expected_checksums} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} G @@ -847,12 +825,12 @@ RSpec.describe "the lockfile format" do gem "rack-obama" G - expected_checksums = checksum_section do |c| - c.repo_gem gem_repo2, "actionpack", "2.3.2" - c.repo_gem gem_repo2, "activesupport", "2.3.2" - c.repo_gem gem_repo2, "rack", "1.0.0" - c.repo_gem gem_repo2, "rack-obama", "1.0" - c.repo_gem gem_repo2, "thin", "1.0" + checksums = checksums_section_when_existing do |c| + c.checksum gem_repo2, "actionpack", "2.3.2" + c.checksum gem_repo2, "activesupport", "2.3.2" + c.checksum gem_repo2, "rack", "1.0.0" + c.checksum gem_repo2, "rack-obama", "1.0" + c.checksum gem_repo2, "thin", "1.0" end expect(lockfile).to eq <<~G @@ -875,10 +853,7 @@ RSpec.describe "the lockfile format" do actionpack rack-obama thin - - CHECKSUMS - #{expected_checksums} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} G @@ -891,14 +866,14 @@ RSpec.describe "the lockfile format" do gem "rails" G - expected_checksums = checksum_section do |c| - c.repo_gem gem_repo2, "actionmailer", "2.3.2" - c.repo_gem gem_repo2, "actionpack", "2.3.2" - c.repo_gem gem_repo2, "activerecord", "2.3.2" - c.repo_gem gem_repo2, "activeresource", "2.3.2" - c.repo_gem gem_repo2, "activesupport", "2.3.2" - c.repo_gem gem_repo2, "rails", "2.3.2" - c.repo_gem gem_repo2, "rake", "13.0.1" + checksums = checksums_section_when_existing do |c| + c.checksum gem_repo2, "actionmailer", "2.3.2" + c.checksum gem_repo2, "actionpack", "2.3.2" + c.checksum gem_repo2, "activerecord", "2.3.2" + c.checksum gem_repo2, "activeresource", "2.3.2" + c.checksum gem_repo2, "activesupport", "2.3.2" + c.checksum gem_repo2, "rails", "2.3.2" + c.checksum gem_repo2, "rake", "13.0.1" end expect(lockfile).to eq <<~G @@ -927,10 +902,7 @@ RSpec.describe "the lockfile format" do DEPENDENCIES rails - - CHECKSUMS - #{expected_checksums} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} G @@ -952,9 +924,9 @@ RSpec.describe "the lockfile format" do gem 'double_deps' G - expected_checksums = checksum_section do |c| - c.repo_gem gem_repo2, "double_deps", "1.0" - c.repo_gem gem_repo2, "net-ssh", "1.0" + checksums = checksums_section_when_existing do |c| + c.checksum gem_repo2, "double_deps", "1.0" + c.checksum gem_repo2, "net-ssh", "1.0" end expect(lockfile).to eq <<~G @@ -971,10 +943,7 @@ RSpec.describe "the lockfile format" do DEPENDENCIES double_deps - - CHECKSUMS - #{expected_checksums} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} G @@ -987,9 +956,9 @@ RSpec.describe "the lockfile format" do gem "rack-obama", ">= 1.0", :require => "rack/obama" G - expected_checksums = checksum_section do |c| - c.repo_gem gem_repo2, "rack", "1.0.0" - c.repo_gem gem_repo2, "rack-obama", "1.0" + checksums = checksums_section_when_existing do |c| + c.checksum gem_repo2, "rack", "1.0.0" + c.checksum gem_repo2, "rack-obama", "1.0" end expect(lockfile).to eq <<~G @@ -1005,10 +974,7 @@ RSpec.describe "the lockfile format" do DEPENDENCIES rack-obama (>= 1.0) - - CHECKSUMS - #{expected_checksums} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} G @@ -1021,9 +987,9 @@ RSpec.describe "the lockfile format" do gem "rack-obama", ">= 1.0", :group => :test G - expected_checksums = checksum_section do |c| - c.repo_gem gem_repo2, "rack", "1.0.0" - c.repo_gem gem_repo2, "rack-obama", "1.0" + checksums = checksums_section_when_existing do |c| + c.checksum gem_repo2, "rack", "1.0.0" + c.checksum gem_repo2, "rack-obama", "1.0" end expect(lockfile).to eq <<~G @@ -1039,10 +1005,7 @@ RSpec.describe "the lockfile format" do DEPENDENCIES rack-obama (>= 1.0) - - CHECKSUMS - #{expected_checksums} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} G @@ -1051,6 +1014,10 @@ RSpec.describe "the lockfile format" do it "stores relative paths when the path is provided in a relative fashion and in Gemfile dir" do build_lib "foo", :path => bundled_app("foo") + checksums = checksums_section_when_existing do |c| + c.no_checksum "foo", "1.0" + end + install_gemfile <<-G source "#{file_uri_for(gem_repo1)}" path "foo" do @@ -1073,10 +1040,7 @@ RSpec.describe "the lockfile format" do DEPENDENCIES foo! - - CHECKSUMS - foo (1.0) - + #{checksums} BUNDLED WITH #{Bundler::VERSION} G @@ -1085,6 +1049,10 @@ RSpec.describe "the lockfile format" do it "stores relative paths when the path is provided in a relative fashion and is above Gemfile dir" do build_lib "foo", :path => bundled_app(File.join("..", "foo")) + checksums = checksums_section_when_existing do |c| + c.no_checksum "foo", "1.0" + end + install_gemfile <<-G source "#{file_uri_for(gem_repo1)}" path "../foo" do @@ -1107,10 +1075,7 @@ RSpec.describe "the lockfile format" do DEPENDENCIES foo! - - CHECKSUMS - foo (1.0) - + #{checksums} BUNDLED WITH #{Bundler::VERSION} G @@ -1119,6 +1084,10 @@ RSpec.describe "the lockfile format" do it "stores relative paths when the path is provided in an absolute fashion but is relative" do build_lib "foo", :path => bundled_app("foo") + checksums = checksums_section_when_existing do |c| + c.no_checksum "foo", "1.0" + end + install_gemfile <<-G source "#{file_uri_for(gem_repo1)}" path File.expand_path("foo", __dir__) do @@ -1141,10 +1110,7 @@ RSpec.describe "the lockfile format" do DEPENDENCIES foo! - - CHECKSUMS - foo (1.0) - + #{checksums} BUNDLED WITH #{Bundler::VERSION} G @@ -1153,6 +1119,10 @@ RSpec.describe "the lockfile format" do it "stores relative paths when the path is provided for gemspec" do build_lib("foo", :path => tmp.join("foo")) + checksums = checksums_section_when_existing do |c| + c.no_checksum "foo", "1.0" + end + install_gemfile <<-G source "#{file_uri_for(gem_repo1)}" gemspec :path => "../foo" @@ -1173,16 +1143,17 @@ RSpec.describe "the lockfile format" do DEPENDENCIES foo! - - CHECKSUMS - foo (1.0) - + #{checksums} BUNDLED WITH #{Bundler::VERSION} G end it "keeps existing platforms in the lockfile" do + checksums = checksums_section_when_existing do |c| + c.no_checksum "rack", "1.0.0" + end + lockfile <<-G GEM remote: #{file_uri_for(gem_repo2)}/ @@ -1194,7 +1165,7 @@ RSpec.describe "the lockfile format" do DEPENDENCIES rack - + #{checksums} BUNDLED WITH #{Bundler::VERSION} G @@ -1205,6 +1176,8 @@ RSpec.describe "the lockfile format" do gem "rack" G + checksums.checksum(gem_repo2, "rack", "1.0.0") + expect(lockfile).to eq <<~G GEM remote: #{file_uri_for(gem_repo2)}/ @@ -1216,10 +1189,7 @@ RSpec.describe "the lockfile format" do DEPENDENCIES rack - - CHECKSUMS - #{checksum_for_repo_gem(gem_repo2, "rack", "1.0.0")} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} G @@ -1239,8 +1209,8 @@ RSpec.describe "the lockfile format" do gem "platform_specific" G - expected_checksums = checksum_section do |c| - c.repo_gem gem_repo2, "platform_specific", "1.0", "universal-java-16" + checksums = checksums_section_when_existing do |c| + c.checksum gem_repo2, "platform_specific", "1.0", "universal-java-16" end expect(lockfile).to eq <<~G @@ -1254,16 +1224,18 @@ RSpec.describe "the lockfile format" do DEPENDENCIES platform_specific - - CHECKSUMS - #{expected_checksums} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} G end it "does not add duplicate gems" do + checksums = checksums_section_when_existing do |c| + c.checksum(gem_repo2, "activesupport", "2.3.5") + c.checksum(gem_repo2, "rack", "1.0.0") + end + install_gemfile <<-G source "#{file_uri_for(gem_repo2)}/" gem "rack" @@ -1288,17 +1260,17 @@ RSpec.describe "the lockfile format" do DEPENDENCIES activesupport rack - - CHECKSUMS - #{checksum_for_repo_gem(gem_repo2, "activesupport", "2.3.5")} - #{checksum_for_repo_gem(gem_repo2, "rack", "1.0.0")} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} G end it "does not add duplicate dependencies" do + checksums = checksums_section_when_existing do |c| + c.checksum(gem_repo2, "rack", "1.0.0") + end + install_gemfile <<-G source "#{file_uri_for(gem_repo2)}/" gem "rack" @@ -1316,16 +1288,17 @@ RSpec.describe "the lockfile format" do DEPENDENCIES rack - - CHECKSUMS - #{checksum_for_repo_gem(gem_repo2, "rack", "1.0.0")} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} G end it "does not add duplicate dependencies with versions" do + checksums = checksums_section_when_existing do |c| + c.checksum(gem_repo2, "rack", "1.0.0") + end + install_gemfile <<-G source "#{file_uri_for(gem_repo2)}/" gem "rack", "1.0" @@ -1343,16 +1316,17 @@ RSpec.describe "the lockfile format" do DEPENDENCIES rack (= 1.0) - - CHECKSUMS - #{checksum_for_repo_gem(gem_repo2, "rack", "1.0.0")} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} G end it "does not add duplicate dependencies in different groups" do + checksums = checksums_section_when_existing do |c| + c.checksum(gem_repo2, "rack", "1.0.0") + end + install_gemfile <<-G source "#{file_uri_for(gem_repo2)}/" gem "rack", "1.0", :group => :one @@ -1370,10 +1344,7 @@ RSpec.describe "the lockfile format" do DEPENDENCIES rack (= 1.0) - - CHECKSUMS - #{checksum_for_repo_gem(gem_repo2, "rack", "1.0.0")} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} G @@ -1402,6 +1373,10 @@ RSpec.describe "the lockfile format" do end it "works correctly with multiple version dependencies" do + checksums = checksums_section_when_existing do |c| + c.checksum(gem_repo2, "rack", "0.9.1") + end + install_gemfile <<-G source "#{file_uri_for(gem_repo2)}/" gem "rack", "> 0.9", "< 1.0" @@ -1418,16 +1393,17 @@ RSpec.describe "the lockfile format" do DEPENDENCIES rack (> 0.9, < 1.0) - - CHECKSUMS - #{checksum_for_repo_gem(gem_repo2, "rack", "0.9.1")} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} G end it "captures the Ruby version in the lockfile" do + checksums = checksums_section_when_existing do |c| + c.checksum(gem_repo2, "rack", "0.9.1") + end + install_gemfile <<-G source "#{file_uri_for(gem_repo2)}/" ruby '#{Gem.ruby_version}' @@ -1445,10 +1421,7 @@ RSpec.describe "the lockfile format" do DEPENDENCIES rack (> 0.9, < 1.0) - - CHECKSUMS - #{checksum_for_repo_gem(gem_repo2, "rack", "0.9.1")} - + #{checksums} RUBY VERSION #{Bundler::RubyVersion.system} @@ -1526,10 +1499,6 @@ RSpec.describe "the lockfile format" do DEPENDENCIES direct_dependency - CHECKSUMS - #{checksum_for_repo_gem(gem_repo4, "direct_dependency", "4.5.6")} - #{checksum_for_repo_gem(gem_repo4, "indirect_dependency", "1.2.3")} - BUNDLED WITH #{Bundler::VERSION} G @@ -1584,10 +1553,6 @@ RSpec.describe "the lockfile format" do DEPENDENCIES minitest-bisect - CHECKSUMS - #{checksum_for_repo_gem(gem_repo4, "minitest-bisect", "1.6.0")} - #{checksum_for_repo_gem(gem_repo4, "path_expander", "1.1.1")} - BUNDLED WITH #{Bundler::VERSION} L @@ -1654,10 +1619,6 @@ RSpec.describe "the lockfile format" do DEPENDENCIES minitest-bisect - CHECKSUMS - #{checksum_for_repo_gem gem_repo4, "minitest-bisect", "1.6.0"} - #{checksum_for_repo_gem gem_repo4, "path_expander", "1.1.1"} - BUNDLED WITH #{Bundler::VERSION} L diff --git a/spec/bundler/plugins/source/example_spec.rb b/spec/bundler/plugins/source/example_spec.rb index 993a890b6c..07302e00d7 100644 --- a/spec/bundler/plugins/source/example_spec.rb +++ b/spec/bundler/plugins/source/example_spec.rb @@ -70,6 +70,10 @@ RSpec.describe "real source plugins" do it "writes to lock file" do bundle "install" + checksums = checksums_section_when_existing do |c| + c.no_checksum "a-path-gem", "1.0" + end + expect(lockfile).to eq <<~G PLUGIN SOURCE remote: #{lib_path("a-path-gem-1.0")} @@ -86,10 +90,7 @@ RSpec.describe "real source plugins" do DEPENDENCIES a-path-gem! - - CHECKSUMS - a-path-gem (1.0) - + #{checksums} BUNDLED WITH #{Bundler::VERSION} G @@ -339,6 +340,10 @@ RSpec.describe "real source plugins" do revision = revision_for(lib_path("ma-gitp-gem-1.0")) bundle "install" + checksums = checksums_section_when_existing do |c| + c.no_checksum "ma-gitp-gem", "1.0" + end + expect(lockfile).to eq <<~G PLUGIN SOURCE remote: #{file_uri_for(lib_path("ma-gitp-gem-1.0"))} @@ -356,10 +361,7 @@ RSpec.describe "real source plugins" do DEPENDENCIES ma-gitp-gem! - - CHECKSUMS - ma-gitp-gem (1.0) - + #{checksums} BUNDLED WITH #{Bundler::VERSION} G diff --git a/spec/bundler/runtime/platform_spec.rb b/spec/bundler/runtime/platform_spec.rb index 82120f75b2..4cbb52764b 100644 --- a/spec/bundler/runtime/platform_spec.rb +++ b/spec/bundler/runtime/platform_spec.rb @@ -73,6 +73,13 @@ RSpec.describe "Bundler.setup with multi platform stuff" do build_gem "racca", "1.5.2" end + checksums = checksums_section do |c| + c.checksum gem_repo4, "mini_portile2", "2.5.0" + c.checksum gem_repo4, "nokogiri", "1.11.1" + c.checksum gem_repo4, "nokogiri", "1.11.1", Bundler.local_platform + c.checksum gem_repo4, "racca", "1.5.2" + end + good_lockfile = <<~L GEM remote: #{file_uri_for(gem_repo4)}/ @@ -90,13 +97,7 @@ RSpec.describe "Bundler.setup with multi platform stuff" do DEPENDENCIES nokogiri (~> 1.11) - - CHECKSUMS - #{checksum_for_repo_gem gem_repo4, "mini_portile2", "2.5.0"} - #{checksum_for_repo_gem gem_repo4, "nokogiri", "1.11.1"} - #{checksum_for_repo_gem gem_repo4, "nokogiri", "1.11.1", Bundler.local_platform} - #{checksum_for_repo_gem gem_repo4, "racca", "1.5.2"} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} L diff --git a/spec/bundler/runtime/setup_spec.rb b/spec/bundler/runtime/setup_spec.rb index 859b7a890a..fde3a34787 100644 --- a/spec/bundler/runtime/setup_spec.rb +++ b/spec/bundler/runtime/setup_spec.rb @@ -1216,6 +1216,10 @@ end let(:ruby_version) { nil } def lock_with(ruby_version = nil) + checksums = checksums_section do |c| + c.checksum gem_repo1, "rack", "1.0.0" + end + lock = <<~L GEM remote: #{file_uri_for(gem_repo1)}/ @@ -1227,9 +1231,7 @@ end DEPENDENCIES rack - - CHECKSUMS - #{checksum_for_repo_gem gem_repo1, "rack", "1.0.0"} + #{checksums} L if ruby_version diff --git a/spec/bundler/support/checksums.rb b/spec/bundler/support/checksums.rb index f0cac4219a..f758559b3b 100644 --- a/spec/bundler/support/checksums.rb +++ b/spec/bundler/support/checksums.rb @@ -3,46 +3,74 @@ module Spec module Checksums class ChecksumsBuilder - def initialize(&block) + def initialize(enabled = true, &block) + @enabled = enabled @checksums = {} yield self if block_given? end - def repo_gem(repo, name, version, platform = Gem::Platform::RUBY) + def initialize_copy(original) + super + @checksums = @checksums.dup + end + + def checksum(repo, name, version, platform = Gem::Platform::RUBY) name_tuple = Gem::NameTuple.new(name, version, platform) gem_file = File.join(repo, "gems", "#{name_tuple.full_name}.gem") File.open(gem_file, "rb") do |f| - @checksums[name_tuple] = Bundler::Checksum.from_gem(f, "#{gem_file} (via ChecksumsBuilder#repo_gem)") + register(name_tuple, Bundler::Checksum.from_gem(f, "#{gem_file} (via ChecksumsBuilder#checksum)")) end end def no_checksum(name, version, platform = Gem::Platform::RUBY) name_tuple = Gem::NameTuple.new(name, version, platform) - @checksums[name_tuple] = nil + register(name_tuple, nil) + end + + def delete(name, platform = nil) + @checksums.reject! {|k, _| k.name == name && (platform.nil? || k.platform == platform) } end - def to_lock - @checksums.map do |name_tuple, checksum| + def to_s + return "" unless @enabled + + locked_checksums = @checksums.map do |name_tuple, checksum| checksum &&= " #{checksum.to_lock}" " #{name_tuple.lock_name}#{checksum}\n" - end.sort.join.strip + end + + "\nCHECKSUMS\n#{locked_checksums.sort.join}" + end + + private + + def register(name_tuple, checksum) + delete(name_tuple.name, name_tuple.platform) + @checksums[name_tuple] = checksum end end - def checksum_section(&block) - ChecksumsBuilder.new(&block).to_lock + def checksums_section(enabled = true, &block) + ChecksumsBuilder.new(enabled, &block) end - def checksum_for_repo_gem(*args) - checksum_section do |c| - c.repo_gem(*args) + def checksums_section_when_existing(&block) + begin + enabled = lockfile.match?(/^CHECKSUMS$/) + rescue Errno::ENOENT + enabled = false end + checksums_section(enabled, &block) end - def gem_no_checksum(*args) - checksum_section do |c| - c.no_checksum(*args) - end + def checksum_to_lock(*args) + checksums_section do |c| + c.checksum(*args) + end.to_s.sub(/^CHECKSUMS\n/, "").strip + end + + def checksum_digest(*args) + checksum_to_lock(*args).split(Bundler::Checksum::ALGO_SEPARATOR, 2).last end # if prefixes is given, removes all checksums where the line @@ -50,6 +78,7 @@ module Spec # otherwise, removes all checksums from the lockfile def remove_checksums_from_lockfile(lockfile, *prefixes) head, remaining = lockfile.split(/^CHECKSUMS$/, 2) + return lockfile unless remaining checksums, tail = remaining.split("\n\n", 2) prefixes = @@ -74,5 +103,12 @@ module Spec tail ) end + + def remove_checksums_section_from_lockfile(lockfile) + head, remaining = lockfile.split(/^CHECKSUMS$/, 2) + return lockfile unless remaining + _checksums, tail = remaining.split("\n\n", 2) + head.concat(tail) + end end end diff --git a/spec/bundler/update/git_spec.rb b/spec/bundler/update/git_spec.rb index eeae4079ca..bfc72b3546 100644 --- a/spec/bundler/update/git_spec.rb +++ b/spec/bundler/update/git_spec.rb @@ -309,6 +309,11 @@ RSpec.describe "bundle update" do bundle "update --source bar" + checksums = checksums_section_when_existing do |c| + c.no_checksum "foo", "2.0" + c.checksum gem_repo2, "rack", "1.0.0" + end + expect(lockfile).to eq <<~G GIT remote: #{@git.path} @@ -327,11 +332,7 @@ RSpec.describe "bundle update" do DEPENDENCIES foo! rack - - CHECKSUMS - foo (2.0) - #{checksum_for_repo_gem gem_repo2, "rack", "1.0.0"} - + #{checksums} BUNDLED WITH #{Bundler::VERSION} G -- cgit v1.2.3