Merge pull request #9651 from ruby/claude/determined-jang-442e41

Reuse RubyGems' vendored SecureRandom in Bundler

Author: hsbt

Manifest.txt

@@ -292,8 +292,6 @@ lib/bundler/vendor/pub_grub/lib/pub_grub/version_constraint.rb
 lib/bundler/vendor/pub_grub/lib/pub_grub/version_range.rb
 lib/bundler/vendor/pub_grub/lib/pub_grub/version_solver.rb
 lib/bundler/vendor/pub_grub/lib/pub_grub/version_union.rb
-lib/bundler/vendor/securerandom/COPYING
-lib/bundler/vendor/securerandom/lib/securerandom.rb
 lib/bundler/vendor/thor/LICENSE.md
 lib/bundler/vendor/thor/lib/thor.rb
 lib/bundler/vendor/thor/lib/thor/actions.rb

bundler.gemspec

@@ -36,9 +36,11 @@ Gem::Specification.new do |s|
 
   s.files = Dir.glob("lib/bundler{.rb,/**/*}", File::FNM_DOTMATCH).reject {|f| File.directory?(f) }
 
-  # Bundler reuses RubyGems' vendored URI. Ship a copy under lib/rubygems so
-  # Bundler stays self-contained on RubyGems versions that predate it.
+  # Bundler reuses RubyGems' vendored URI and SecureRandom. Ship a copy under
+  # lib/rubygems so Bundler stays self-contained on RubyGems versions that
+  # predate them.
   s.files += Dir.glob("lib/rubygems/vendor/uri/**/*", File::FNM_DOTMATCH).reject {|f| File.directory?(f) }
+  s.files += Dir.glob("lib/rubygems/vendor/securerandom/**/*", File::FNM_DOTMATCH).reject {|f| File.directory?(f) }
 
   # include the gemspec itself because warbler breaks w/o it
   s.files += %w[bundler.gemspec]

lib/bundler/vendor/securerandom/COPYING

@@ -1,12 +1,15 @@
 # frozen_string_literal: true
 
-# Use RubyGems vendored copy when available. Otherwise fallback to Bundler
-# vendored copy. The vendored copy in Bundler can be removed once support for
-# RubyGems 3.5.18 is dropped.
+# Reuse RubyGems' vendored SecureRandom (Gem::SecureRandom). The Bundler gem
+# ships a copy under lib/rubygems/vendor, so this resolves even on RubyGems
+# versions that predate it. Fall back to the stdlib only when no vendored copy
+# is available at all.
 
-begin
-  require "rubygems/vendored_securerandom"
-rescue LoadError
-  require_relative "vendor/securerandom/lib/securerandom"
-  Gem::SecureRandom = Bundler::SecureRandom
+unless defined?(Gem::SecureRandom)
+  begin
+    require "rubygems/vendor/securerandom/lib/securerandom"
+  rescue LoadError
+    require "securerandom"
+    Gem::SecureRandom = SecureRandom
+  end
 end

lib/bundler/vendor/securerandom/lib/securerandom.rb

@@ -38,6 +38,10 @@
 # If a secure random number generator is not available,
 # +NotImplementedError+ is raised.
 
+# Skip reloading when an identical copy (e.g. the one shipped inside the Bundler
+# gem) was already required from a different path, to avoid redefinition warnings.
+return if defined?(Gem::SecureRandom::VERSION)
+
 module Gem::SecureRandom
 
   # The version

lib/bundler/vendored_securerandom.rb

@@ -345,7 +345,7 @@ def git_ls_files(glob)
     end
 
     def tracked_files_glob
-      ruby_core? ? "libexec/bundle* lib/bundler lib/bundler.rb lib/rubygems/vendor/uri spec/bundler man/bundle*" : "exe/bundle exe/bundler lib/bundler lib/bundler.rb lib/rubygems/vendor/uri bundler.gemspec CHANGELOG-bundler.md LICENSE-bundler.md README-bundler.md"
+      ruby_core? ? "libexec/bundle* lib/bundler lib/bundler.rb lib/rubygems/vendor/uri lib/rubygems/vendor/securerandom spec/bundler man/bundle*" : "exe/bundle exe/bundler lib/bundler lib/bundler.rb lib/rubygems/vendor/uri lib/rubygems/vendor/securerandom bundler.gemspec CHANGELOG-bundler.md LICENSE-bundler.md README-bundler.md"
     end
 
     def lib_tracked_files_glob

lib/rubygems/vendor/securerandom/lib/securerandom.rb

@@ -0,0 +1,15 @@
+diff --git a/lib/rubygems/vendor/securerandom/lib/securerandom.rb b/lib/rubygems/vendor/securerandom/lib/securerandom.rb
+index b6f1d71ad3..dd759fedaa 100644
+--- a/lib/rubygems/vendor/securerandom/lib/securerandom.rb
++++ b/lib/rubygems/vendor/securerandom/lib/securerandom.rb
+@@ -38,6 +38,10 @@
+ # If a secure random number generator is not available,
+ # +NotImplementedError+ is raised.
+ 
++# Skip reloading when an identical copy (e.g. the one shipped inside the Bundler
++# gem) was already required from a different path, to avoid redefinition warnings.
++return if defined?(Gem::SecureRandom::VERSION)
++
+ module Gem::SecureRandom
+ 
+   # The version

spec/support/path.rb

@@ -86,7 +86,7 @@ def require_target
   VendoredGem.new(name: "net-protocol", namespace: "Net", prefix: "Gem", vendor_lib: "lib/rubygems/vendor/net-protocol", license_path: "LICENSE.txt"),
   VendoredGem.new(name: "optparse", namespace: "OptionParser", prefix: "Gem", vendor_lib: "lib/rubygems/vendor/optparse", license_path: "COPYING", extra_dependencies: %w[uri/lib/rubygems/vendor/uri], patch_name: "optparse-v0.8.0.patch"),
   VendoredGem.new(name: "resolv", namespace: "Resolv", prefix: "Gem", vendor_lib: "lib/rubygems/vendor/resolv", license_path: "COPYING", extra_dependencies: %w[securerandom/lib/rubygems/vendor/securerandom timeout], patch_name: "resolv-v0.7.0.patch"),
-  VendoredGem.new(name: "securerandom", namespace: "SecureRandom", prefix: "Gem", vendor_lib: "lib/rubygems/vendor/securerandom", license_path: "COPYING"),
+  VendoredGem.new(name: "securerandom", namespace: "SecureRandom", prefix: "Gem", vendor_lib: "lib/rubygems/vendor/securerandom", license_path: "COPYING", patch_name: "securerandom-rubygems.patch"),
   VendoredGem.new(name: "timeout", namespace: "Timeout", prefix: "Gem", vendor_lib: "lib/rubygems/vendor/timeout", license_path: "COPYING", patch_name: "timeout-v0.4.3.patch"),
   VendoredGem.new(name: "tsort", namespace: "TSort", prefix: "Gem", vendor_lib: "lib/rubygems/vendor/tsort", license_path: "LICENSE.txt"),
   VendoredGem.new(name: "uri", namespace: "URI", prefix: "Gem", vendor_lib: "lib/rubygems/vendor/uri", license_path: "COPYING", patch_name: "uri-rubygems.patch"),
@@ -95,7 +95,6 @@ def require_target
   VendoredGem.new(name: "fileutils", namespace: "FileUtils", prefix: "Bundler", vendor_lib: "lib/bundler/vendor/fileutils", license_path: "COPYING"),
   VendoredGem.new(name: "pub_grub", namespace: "PubGrub", prefix: "Bundler", vendor_lib: "lib/bundler/vendor/pub_grub", license_path: "LICENSE.txt"),
   VendoredGem.new(name: "thor", namespace: "Thor", prefix: "Bundler", vendor_lib: "lib/bundler/vendor/thor", license_path: "LICENSE.md", patch_name: "thor-v1.4.0.patch"),
-  VendoredGem.new(name: "securerandom", namespace: "SecureRandom", prefix: "Bundler", vendor_lib: "lib/bundler/vendor/securerandom", license_path: "COPYING"),
 ].group_by(&:name)
 
 Bundler.definition.resolve.materialized_for_all_platforms.reject {|s| ignore.include?(s.name) }.each do |s|