Remove the short-name content-addressed gem after a wide-named identical gem has been installed

Author: OughtPuts

lib/bundler/rubygems_gem_installer.rb

@@ -68,6 +68,10 @@ def install
 
       run_post_install_hooks
 
+      if spec.content_address && spec.content_address.length > Gem::ContentAddress::DEFAULT_LENGTH
+        remove_stale_matching_gems
+      end
+
       spec
     end
 

lib/rubygems/installer.rb

@@ -11,6 +11,7 @@
 require_relative "package"
 require_relative "ext"
 require_relative "user_interaction"
+require_relative "uninstaller"
 
 ##
 # The installer installs the files contained in the .gem into the Gem.home.
@@ -314,6 +315,10 @@ def install
 
     run_post_install_hooks
 
+    if spec.content_address && spec.content_address.length > Gem::ContentAddress::DEFAULT_LENGTH
+      remove_stale_matching_gems
+    end
+
     spec
   rescue Errno::EACCES => e
     # Permission denied - /path/to/foo
@@ -973,6 +978,26 @@ def ensure_writable_dir(dir) # :nodoc:
 
   private
 
+  def remove_stale_matching_gems
+    require "digest"
+    incoming_sha = Digest::SHA256.file(gem).hexdigest
+    installed_specs.each do |installed_spec|
+      next unless installed_spec.name == spec.name
+      next unless installed_spec.version == spec.version
+      next unless installed_spec.platform == spec.platform
+      next unless installed_spec.ruby_abi == spec.ruby_abi
+      next unless installed_spec.content_address&.length == Gem::ContentAddress::DEFAULT_LENGTH
+      next unless spec.content_address.start_with?(installed_spec.content_address)
+      next unless File.exist?(installed_spec.cache_file)
+      installed_sha = Digest::SHA256.file(installed_spec.cache_file).hexdigest
+      next unless installed_sha == incoming_sha
+
+      uninstaller = Gem::Uninstaller.new(nil, install_dir: gem_home)
+      uninstaller.remove(installed_spec)
+      Gem::Specification.remove_spec(installed_spec) unless @install_dir
+    end
+  end
+
   def assign_content_address
     address = @package.content_address
     expected = options[:content_address]

test/rubygems/test_gem_installer.rb

@@ -1390,6 +1390,125 @@ def test_reinstalling_content_addressed_gem_is_idempotent
     assert_equal 1, Dir[File.join(@gemhome, "specifications", "a-2*.gemspec")].size
   end
 
+  def test_reinstalling_a_content_addressed_gem_with_a_widened_sha_removes_the_old_gem
+    source_spec, a_gem = util_gem("a", 2) do |spec|
+      spec.required_ruby_version = "~> 3.4.0"
+      spec.platform = "x86_64-linux"
+    end
+    FileUtils.rm_rf source_spec.gem_dir
+
+    digest = Digest::SHA256.file(a_gem).hexdigest
+    address = digest[0, 8]
+    dir = File.dirname(a_gem)
+    filename = File.join(dir, "a-2-#{address}.gem")
+    FileUtils.cp a_gem, filename
+    installer = Gem::Installer.at filename, install_dir: @gemhome, force: true
+    short_spec = installer.install
+    short_extension_dir = short_spec.extension_dir
+    FileUtils.mkdir_p short_extension_dir
+    assert_path_exist short_extension_dir
+
+    widened_address = digest[0, 12]
+    widened_filename = File.join(dir, "a-2-#{widened_address}.gem")
+    FileUtils.cp a_gem, widened_filename
+    installer2 = Gem::Installer.at widened_filename, install_dir: @gemhome, force: true
+    spec2 = installer2.install
+
+    assert_path_not_exist short_extension_dir
+    assert_equal "a-2-#{widened_address}", spec2.full_name
+    assert_path_exist File.join(@gemhome, "gems", "a-2-#{widened_address}")
+    assert_path_exist File.join(@gemhome, "specifications", "a-2-#{widened_address}.gemspec")
+    assert_equal 1, Dir[File.join(@gemhome, "gems", "a-2*")].size
+    assert_equal 1, Dir[File.join(@gemhome, "specifications", "a-2*.gemspec")].size
+  end
+
+  def test_reinstalling_with_a_widened_sha_removes_the_old_specification_from_the_record
+    source_spec, a_gem = util_gem("a", 2) do |spec|
+      spec.required_ruby_version = "~> 3.4.0"
+      spec.platform = "x86_64-linux"
+    end
+    FileUtils.rm_rf source_spec.gem_dir
+
+    digest = Digest::SHA256.file(a_gem).hexdigest
+    address = digest[0, 8]
+    dir = File.dirname(a_gem)
+    filename = File.join(dir, "a-2-#{address}.gem")
+    FileUtils.cp a_gem, filename
+    short_spec = Gem::Installer.at(filename, force: true).install
+
+    assert_includes Gem::Specification.stubs.map(&:full_name), short_spec.full_name
+
+    widened_address = digest[0, 12]
+    widened_filename = File.join(dir, "a-2-#{widened_address}.gem")
+    FileUtils.cp a_gem, widened_filename
+    widened_spec = Gem::Installer.at(widened_filename, force: true).install
+
+    refute_includes Gem::Specification.stubs.map(&:full_name), short_spec.full_name
+    assert_includes Gem::Specification.stubs.map(&:full_name), widened_spec.full_name
+  end
+
+  def test_installing_widened_gem_does_not_remove_short_gem_when_checksums_differ
+    source_spec, a_gem = util_gem("a", 2) do |spec|
+      spec.required_ruby_version = "~> 3.4.0"
+      spec.platform = "x86_64-linux"
+    end
+    FileUtils.rm_rf source_spec.gem_dir
+
+    digest = Digest::SHA256.file(a_gem).hexdigest
+    address = digest[0, 8]
+    dir = File.dirname(a_gem)
+    filename = File.join(dir, "a-2-#{address}.gem")
+    FileUtils.cp a_gem, filename
+    installer = Gem::Installer.at filename, install_dir: @gemhome, force: true
+    short_spec = installer.install
+    File.binwrite(short_spec.cache_file, "different gem contents")
+
+    widened_address = digest[0, 12]
+    widened_filename = File.join(dir, "a-2-#{widened_address}.gem")
+    FileUtils.cp a_gem, widened_filename
+    installer2 = Gem::Installer.at widened_filename, install_dir: @gemhome, force: true
+    spec2 = installer2.install
+
+    assert_path_exist File.join(@gemhome, "gems", "a-2-#{address}")
+    assert_path_exist File.join(@gemhome, "specifications", "a-2-#{address}.gemspec")
+    assert_equal "a-2-#{widened_address}", spec2.full_name
+    assert_path_exist File.join(@gemhome, "gems", "a-2-#{widened_address}")
+    assert_path_exist File.join(@gemhome, "specifications", "a-2-#{widened_address}.gemspec")
+    assert_equal 2, Dir[File.join(@gemhome, "gems", "a-2*")].size
+    assert_equal 2, Dir[File.join(@gemhome, "specifications", "a-2*.gemspec")].size
+    assert_path_exist short_spec.cache_file
+  end
+
+  def test_failed_widened_install_does_not_remove_existing_short_gem
+    source_spec, a_gem = util_gem("a", 2) do |spec|
+      spec.required_ruby_version = "~> 3.4.0"
+      spec.platform = "x86_64-linux"
+    end
+    FileUtils.rm_rf source_spec.gem_dir
+
+    digest = Digest::SHA256.file(a_gem).hexdigest
+    address = digest[0, 8]
+    dir = File.dirname(a_gem)
+    filename = File.join(dir, "a-2-#{address}.gem")
+    FileUtils.cp a_gem, filename
+    short_spec = Gem::Installer.at(filename, install_dir: @gemhome, force: true).install
+
+    widened_address = digest[0, 12]
+    widened_filename = File.join(dir, "a-2-#{widened_address}.gem")
+    FileUtils.cp a_gem, widened_filename
+    widened_installer = Gem::Installer.at widened_filename, install_dir: @gemhome, force: true
+
+    Gem.pre_install { false }
+
+    assert_raise Gem::InstallError do
+      widened_installer.install
+    end
+
+    assert_path_exist short_spec.full_gem_path
+    assert_path_exist short_spec.spec_file
+    assert_path_exist short_spec.cache_file
+  end
+
   def test_install_assigns_content_address_from_filename_with_full_sha
     _, a_gem = util_gem("a", 2) do |spec|
       spec.required_ruby_version = "~> 3.4.0"