From 279dcfab7aea4474c6722fd39cbf65017edb4b2b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?David=20Rodr=C3=ADguez?= <deivid.rodriguez@riseup.net>
Date: Fri, 25 Aug 2023 09:55:37 +0200
Subject: [PATCH] [rubygems/rubygems] Fix standalone install crashing when
 using legacy multi remote gemfiles

If a legacy multi remote Gemfile depends transitively on a default gem,
then in standalone mode we'd fail to fetch the proper version from the
source that includes it, since we were adding it to `specs` (instead of
`remote_specs`), which was already including the default version of the
gem, and thus preventing the remote version from "overwriting that" and
being added to the index. We should add it to the `remote_specs` index
directly instead.

https://github.com/rubygems/rubygems/commit/05f4f9dfc0
---
 lib/bundler/source/rubygems.rb               |  4 ++-
 spec/bundler/install/gemfile/sources_spec.rb | 27 ++++++++++++++++++++
 2 files changed, 30 insertions(+), 1 deletion(-)

diff --git a/lib/bundler/source/rubygems.rb b/lib/bundler/source/rubygems.rb
index 15bd8dacbb..7a80ec2b00 100644
--- a/lib/bundler/source/rubygems.rb
+++ b/lib/bundler/source/rubygems.rb
@@ -275,7 +275,9 @@ module Bundler
 
         Bundler.ui.debug "Double checking for #{unmet_dependency_names || "all specs (due to the size of the request)"} in #{self}"
 
-        fetch_names(api_fetchers, unmet_dependency_names, specs, false)
+        fetch_names(api_fetchers, unmet_dependency_names, remote_specs, false)
+
+        specs.use(remote_specs, false)
       end
 
       def dependency_names_to_double_check
diff --git a/spec/bundler/install/gemfile/sources_spec.rb b/spec/bundler/install/gemfile/sources_spec.rb
index 1f89f9f0f9..8cb0476821 100644
--- a/spec/bundler/install/gemfile/sources_spec.rb
+++ b/spec/bundler/install/gemfile/sources_spec.rb
@@ -78,6 +78,33 @@ RSpec.describe "bundle install with gems on multiple sources" do
     end
   end
 
+  context "without source affinity, and a stdlib gem present in one of the sources", :ruby_repo do
+    let(:default_json_version) { ruby "gem 'json'; require 'json'; puts JSON::VERSION" }
+
+    before do
+      build_repo2 do
+        build_gem "json", default_json_version
+      end
+
+      build_repo4 do
+        build_gem "foo" do |s|
+          s.add_dependency "json", default_json_version
+        end
+      end
+
+      gemfile <<-G
+        source "https://gem.repo2"
+        source "https://gem.repo4"
+
+        gem "foo"
+      G
+    end
+
+    it "works in standalone mode", :bundler => "< 3" do
+      bundle "install --standalone", :artifice => "compact_index"
+    end
+  end
+
   context "with source affinity" do
     context "with sources given by a block" do
       before do