1berry/ruby
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

[rubygems/rubygems] Store Checksum::Store indexed by spec.lock_name

Browse Source 
https://github.com/rubygems/rubygems/commit/34d6c6c72f
This commit is contained in:
Martin Emde 2023-12-13 11:15:51 -08:00 committed by git
parent 14c7895c21
commit 7f4b271a61
2 changed files with 20 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
lib/bundler/checksum.rb
View File

@ -165,8 +165,8 @@ module Bundler
def initialize_copy(other) def initialize_copy(other)
@store = {} @store = {}
other.store.each do |name_tuple, checksums| other.store.each do |lock_name, checksums|
store[name_tuple] = checksums.dup store[lock_name] = checksums.dup
end end
end end
@ -175,7 +175,7 @@ module Bundler
end end
def fetch(spec, algo = DEFAULT_ALGORITHM) def fetch(spec, algo = DEFAULT_ALGORITHM)
store[spec.name_tuple]&.fetch(algo, nil) store[spec.name_tuple.lock_name]&.fetch(algo, nil)
end end
# Replace when the new checksum is from the same source. # Replace when the new checksum is from the same source.
@ -191,45 +191,45 @@ module Bundler
def replace(spec, checksum) def replace(spec, checksum)
return unless checksum return unless checksum
name_tuple = spec.name_tuple lock_name = spec.name_tuple.lock_name
checksums = (store[name_tuple] ||= {}) checksums = (store[lock_name] ||= {})
existing = checksums[checksum.algo] existing = checksums[checksum.algo]
# we assume only one source because this is used while building the index # we assume only one source because this is used while building the index
if !existing || existing.sources.first == checksum.sources.first if !existing || existing.sources.first == checksum.sources.first
checksums[checksum.algo] = checksum checksums[checksum.algo] = checksum
else else
register_checksum(name_tuple, checksum) register_checksum(lock_name, checksum)
end end
end end
def register(spec, checksum) def register(spec, checksum)
return unless checksum return unless checksum
register_checksum(spec.name_tuple, checksum) register_checksum(spec.name_tuple.lock_name, checksum)
end end
def merge!(other) def merge!(other)
other.store.each do |name_tuple, checksums| other.store.each do |lock_name, checksums|
checksums.each do |_algo, checksum| checksums.each do |_algo, checksum|
register_checksum(name_tuple, checksum) register_checksum(lock_name, checksum)
end end
end end
end end
def to_lock(spec) def to_lock(spec)
name_tuple = spec.name_tuple lock_name = spec.name_tuple.lock_name
if checksums = store[name_tuple] if checksums = store[lock_name]
"#{name_tuple.lock_name} #{checksums.values.map(&:to_lock).sort.join(",")}" "#{lock_name} #{checksums.values.map(&:to_lock).sort.join(",")}"
else else
name_tuple.lock_name lock_name
end end
end end
private private
def register_checksum(name_tuple, checksum) def register_checksum(lock_name, checksum)
return unless checksum return unless checksum
checksums = (store[name_tuple] ||= {}) checksums = (store[lock_name] ||= {})
existing = checksums[checksum.algo] existing = checksums[checksum.algo]
if !existing if !existing
@ -237,7 +237,7 @@ module Bundler
elsif existing.merge!(checksum) elsif existing.merge!(checksum)
checksum checksum
else else
raise ChecksumMismatchError.new(name_tuple, existing, checksum) raise ChecksumMismatchError.new(lock_name, existing, checksum)
end end
end end
end end

8
lib/bundler/errors.rb
View File

@ -53,8 +53,8 @@ module Bundler
class MarshalError < StandardError; end class MarshalError < StandardError; end
class ChecksumMismatchError < SecurityError class ChecksumMismatchError < SecurityError
def initialize(name_tuple, existing, checksum) def initialize(lock_name, existing, checksum)
@name_tuple = name_tuple @lock_name = lock_name
@existing = existing @existing = existing
@checksum = checksum @checksum = checksum
end end
@ -62,9 +62,9 @@ module Bundler
def message def message
<<~MESSAGE <<~MESSAGE
Bundler found mismatched checksums. This is a potential security risk. Bundler found mismatched checksums. This is a potential security risk.
#{@name_tuple.lock_name} #{@existing.to_lock} #{@lock_name} #{@existing.to_lock}
from #{@existing.sources.join("\n and ")} from #{@existing.sources.join("\n and ")}
#{@name_tuple.lock_name} #{@checksum.to_lock} #{@lock_name} #{@checksum.to_lock}
from #{@checksum.sources.join("\n and ")} from #{@checksum.sources.join("\n and ")}
#{mismatch_resolution_instructions} #{mismatch_resolution_instructions}