Merge pull request #8968 from rubygems/deivid-rodriguez/remove-global-multisource-support

Remove support for multiple global sources in Gemfile & lockfile

Author: deivid-rodriguez

bundler/lib/bundler/cli/install.rb

@@ -69,8 +69,6 @@ def run
 
       Bundler::CLI::Common.output_post_install_messages installer.post_install_messages
 
-      warn_ambiguous_gems
-
       if CLI::Common.clean_after_install?
         require_relative "clean"
         Bundler::CLI::Clean.new(options).run
@@ -126,19 +124,5 @@ def normalize_settings
 
       options[:force] = options[:redownload] if options[:redownload]
     end
-
-    def warn_ambiguous_gems
-      # TODO: remove this when we drop Bundler 1.x support
-      Installer.ambiguous_gems.to_a.each do |name, installed_from_uri, *also_found_in_uris|
-        Bundler.ui.warn "Warning: the gem '#{name}' was found in multiple sources."
-        Bundler.ui.warn "Installed from: #{installed_from_uri}"
-        Bundler.ui.warn "Also found in:"
-        also_found_in_uris.each {|uri| Bundler.ui.warn "  * #{uri}" }
-        Bundler.ui.warn "You should add a source requirement to restrict this gem to your preferred source."
-        Bundler.ui.warn "For example:"
-        Bundler.ui.warn "    gem '#{name}', :source => '#{installed_from_uri}'"
-        Bundler.ui.warn "Then uninstall the gem '#{name}' (or delete all bundled gems) and then install again."
-      end
-    end
   end
 end

bundler/lib/bundler/definition.rb

@@ -107,14 +107,24 @@ def initialize(lockfile, dependencies, sources, unlock, ruby_version = nil, opti
         @locked_ruby_version = @locked_gems.ruby_version
         @locked_deps = @locked_gems.dependencies
         @originally_locked_specs = SpecSet.new(@locked_gems.specs)
+        @originally_locked_sources = @locked_gems.sources
         @locked_checksums = @locked_gems.checksums
 
         if @unlocking_all
           @locked_specs   = SpecSet.new([])
           @locked_sources = []
         else
           @locked_specs   = @originally_locked_specs
-          @locked_sources = @locked_gems.sources
+          @locked_sources = @originally_locked_sources
+        end
+
+        locked_gem_sources = @originally_locked_sources.select {|s| s.is_a?(Source::Rubygems) }
+        multisource_lockfile = locked_gem_sources.size == 1 && locked_gem_sources.first.multiple_remotes?
+
+        if multisource_lockfile
+          msg = "Your lockfile contains a single rubygems source section with multiple remotes, which is insecure. Make sure you run `bundle install` in non frozen mode and commit the result to make your lockfile secure."
+
+          Bundler::SharedHelpers.feature_removed! msg
         end
       else
         @locked_gems = nil
@@ -123,24 +133,12 @@ def initialize(lockfile, dependencies, sources, unlock, ruby_version = nil, opti
         @platforms      = []
         @locked_deps    = {}
         @locked_specs   = SpecSet.new([])
-        @originally_locked_specs = @locked_specs
         @locked_sources = []
+        @originally_locked_specs = @locked_specs
+        @originally_locked_sources = @locked_sources
         @locked_checksums = Bundler.feature_flag.lockfile_checksums?
       end
 
-      locked_gem_sources = @locked_sources.select {|s| s.is_a?(Source::Rubygems) }
-      @multisource_allowed = locked_gem_sources.size == 1 && locked_gem_sources.first.multiple_remotes? && Bundler.frozen_bundle?
-
-      if @multisource_allowed
-        unless sources.aggregate_global_source?
-          msg = "Your lockfile contains a single rubygems source section with multiple remotes, which is insecure. Make sure you run `bundle install` in non frozen mode and commit the result to make your lockfile secure."
-
-          Bundler::SharedHelpers.major_deprecation 2, msg
-        end
-
-        @sources.merged_gem_lockfile_sections!(locked_gem_sources.first)
-      end
-
       @unlocking_ruby ||= if @ruby_version && locked_ruby_version_object
         @ruby_version.diff(locked_ruby_version_object)
       end
@@ -763,7 +761,7 @@ def start_resolution
     end
 
     def precompute_source_requirements_for_indirect_dependencies?
-      sources.non_global_rubygems_sources.all?(&:dependency_api_available?) && !sources.aggregate_global_source?
+      sources.non_global_rubygems_sources.all?(&:dependency_api_available?)
     end
 
     def current_platform_locked?
@@ -954,7 +952,7 @@ def converge_sources
       sources.all_sources.each do |source|
         # has to be done separately, because we want to keep the locked checksum
         # store for a source, even when doing a full update
-        if @locked_checksums && @locked_gems && locked_source = @locked_gems.sources.find {|s| s == source && !s.equal?(source) }
+        if @locked_checksums && @locked_gems && locked_source = @originally_locked_sources.find {|s| s == source && !s.equal?(source) }
           source.checksum_store.merge!(locked_source.checksum_store)
         end
         # If the source is unlockable and the current command allows an unlock of
@@ -1137,7 +1135,7 @@ def lockfiles_equal?(current, proposed, preserve_unknown_sections)
     end
 
     def additional_base_requirements_to_prevent_downgrades(resolution_base)
-      return resolution_base unless @locked_gems && !sources.expired_sources?(@locked_gems.sources)
+      return resolution_base unless @locked_gems
       @originally_locked_specs.each do |locked_spec|
         next if locked_spec.source.is_a?(Source::Path) || locked_spec.source_changed?
 

bundler/lib/bundler/dsl.rb

@@ -521,24 +521,10 @@ def check_rubygems_source_safety
     end
 
     def multiple_global_source_warning
-      if Bundler.feature_flag.bundler_4_mode?
-        msg = "This Gemfile contains multiple global sources. " \
-          "Each source after the first must include a block to indicate which gems " \
-          "should come from that source"
-        raise GemfileEvalError, msg
-      else
-        message =
-          "Your Gemfile contains multiple global sources. " \
-          "Using `source` more than once without a block is a security risk, and " \
-          "may result in installing unexpected gems. To resolve this warning, use " \
-          "a block to indicate which gems should come from the secondary source."
-        removed_message =
-          "Your Gemfile contains multiple global sources. " \
-          "Using `source` more than once without a block is a security risk, and " \
-          "may result in installing unexpected gems. To resolve this error, use " \
-          "a block to indicate which gems should come from the secondary source."
-        Bundler::SharedHelpers.major_deprecation 2, message, removed_message: removed_message
-      end
+      msg = "This Gemfile contains multiple global sources. " \
+        "Each source after the first must include a block to indicate which gems " \
+        "should come from that source"
+      raise GemfileEvalError, msg
     end
 
     class DSLError < GemfileError

bundler/lib/bundler/errors.rb

@@ -77,11 +77,6 @@ def message
     def mismatch_resolution_instructions
       removable, remote = [@existing, @checksum].partition(&:removable?)
       case removable.size
-      when 0
-        msg = +"Mismatched checksums each have an authoritative source:\n"
-        msg << "  1. #{@existing.sources.reject(&:removable?).map(&:to_s).join(" and ")}\n"
-        msg << "  2. #{@checksum.sources.reject(&:removable?).map(&:to_s).join(" and ")}\n"
-        msg << "You may need to alter your Gemfile sources to resolve this issue.\n"
       when 1
         msg = +"If you trust #{remote.first.sources.first}, to resolve this issue you can:\n"
         msg << removable.first.removal_instructions

bundler/lib/bundler/index.rb

@@ -46,13 +46,6 @@ def empty?
       true
     end
 
-    def search_all(name, &blk)
-      return enum_for(:search_all, name) unless blk
-      specs_by_name(name).each(&blk)
-      @duplicates[name]&.each(&blk)
-      @sources.each {|source| source.search_all(name, &blk) }
-    end
-
     # Search this index's specs, and any source indexes that this index knows
     # about, returning all of the results.
     def search(query)

bundler/lib/bundler/installer.rb

@@ -7,12 +7,6 @@
 
 module Bundler
   class Installer
-    class << self
-      attr_accessor :ambiguous_gems
-
-      Installer.ambiguous_gems = []
-    end
-
     attr_reader :post_install_messages, :definition
 
     # Begins the installation process for Bundler.

bundler/lib/bundler/plugin/source_list.rb

@@ -23,7 +23,7 @@ def all_sources
 
       private
 
-      def rubygems_aggregate_class
+      def source_class
         Plugin::Installer::Rubygems
       end
     end

bundler/lib/bundler/source/rubygems.rb

@@ -168,12 +168,6 @@ def install(spec, options = {})
           return nil # no post-install message
         end
 
-        if spec.remote
-          # Check for this spec from other sources
-          uris = [spec.remote, *remotes_for_spec(spec)].map(&:anonymized_uri).uniq
-          Installer.ambiguous_gems << [spec.name, *uris] if uris.length > 1
-        end
-
         path = fetch_gem_if_possible(spec, options[:previous_spec])
         raise GemNotFound, "Could not find #{spec.file_name} for installation" unless path
 
@@ -332,13 +326,6 @@ def credless_remotes
         remotes.map(&method(:remove_auth))
       end
 
-      def remotes_for_spec(spec)
-        specs.search_all(spec.name).inject([]) do |uris, s|
-          uris << s.remote if s.remote
-          uris
-        end
-      end
-
       def cached_gem(spec)
         global_cache_path = download_cache_path(spec)
         caches << global_cache_path if global_cache_path

bundler/lib/bundler/source_list.rb

@@ -9,7 +9,7 @@ class SourceList
       :metadata_source
 
     def global_rubygems_source
-      @global_rubygems_source ||= rubygems_aggregate_class.new("allow_local" => true)
+      @global_rubygems_source ||= source_class.new("allow_local" => true)
     end
 
     def initialize
@@ -21,19 +21,9 @@ def initialize
       @rubygems_sources       = []
       @metadata_source        = Source::Metadata.new
 
-      @merged_gem_lockfile_sections = false
       @local_mode = true
     end
 
-    def merged_gem_lockfile_sections?
-      @merged_gem_lockfile_sections
-    end
-
-    def merged_gem_lockfile_sections!(replacement_source)
-      @merged_gem_lockfile_sections = true
-      @global_rubygems_source = replacement_source
-    end
-
     def aggregate_global_source?
       global_rubygems_source.multiple_remotes?
     end
@@ -90,10 +80,6 @@ def non_global_rubygems_sources
       @rubygems_sources
     end
 
-    def rubygems_remotes
-      rubygems_sources.flat_map(&:remotes).uniq
-    end
-
     def all_sources
       path_sources + git_sources + plugin_sources + rubygems_sources + [metadata_source]
     end
@@ -115,11 +101,7 @@ def lock_other_sources
     end
 
     def lock_rubygems_sources
-      if merged_gem_lockfile_sections?
-        [combine_rubygems_sources]
-      else
-        rubygems_sources.sort_by(&:identifier)
-      end
+      rubygems_sources.sort_by(&:identifier)
     end
 
     # Returns true if there are changes
@@ -129,16 +111,7 @@ def replace_sources!(replacement_sources)
       @rubygems_sources, @path_sources, @git_sources, @plugin_sources = map_sources(replacement_sources)
       @global_rubygems_source = global_replacement_source(replacement_sources)
 
-      different_sources?(lock_sources, replacement_sources)
-    end
-
-    # Returns true if there are changes
-    def expired_sources?(replacement_sources)
-      return false if replacement_sources.empty?
-
-      lock_sources = dup_with_replaced_sources(replacement_sources).lock_sources
-
-      different_sources?(lock_sources, replacement_sources)
+      !equivalent_sources?(lock_sources, replacement_sources)
     end
 
     def prefer_local!
@@ -165,12 +138,6 @@ def remote!
 
     private
 
-    def dup_with_replaced_sources(replacement_sources)
-      new_source_list = dup
-      new_source_list.replace_sources!(replacement_sources)
-      new_source_list
-    end
-
     def map_sources(replacement_sources)
       rubygems = @rubygems_sources.map do |source|
         replace_rubygems_source(replacement_sources, source)
@@ -224,11 +191,7 @@ def replace_path_source(replacement_sources, gemfile_source)
       end
     end
 
-    def different_sources?(lock_sources, replacement_sources)
-      !equivalent_sources?(lock_sources, replacement_sources)
-    end
-
-    def rubygems_aggregate_class
+    def source_class
       Source::Rubygems
     end
 
@@ -247,10 +210,6 @@ def source_list_for(source)
       end
     end
 
-    def combine_rubygems_sources
-      Source::Rubygems.new("remotes" => rubygems_remotes)
-    end
-
     def warn_on_git_protocol(source)
       return if Bundler.settings["git.allow_insecure"]
 

bundler/lib/bundler/source_map.rb

@@ -23,15 +23,12 @@ def all_requirements
           if previous_source.nil?
             requirements[indirect_dependency_name] = source
           else
-            no_ambiguous_sources = Bundler.feature_flag.bundler_4_mode?
-
             msg = ["The gem '#{indirect_dependency_name}' was found in multiple relevant sources."]
             msg.concat [previous_source, source].map {|s| "  * #{s}" }.sort
-            msg << "You #{no_ambiguous_sources ? :must : :should} add this gem to the source block for the source you wish it to be installed from."
+            msg << "You must add this gem to the source block for the source you wish it to be installed from."
             msg = msg.join("\n")
 
-            raise SecurityError, msg if no_ambiguous_sources
-            Bundler.ui.warn "Warning: #{msg}"
+            raise SecurityError, msg
           end
         end