merge revision(s) 62244,62246,62301,62302,62303,62422,62436,62452: [Backport #14481]

Merge RubyGems-2.7.5 from upstream.

	  Please see its details: http://blog.rubygems.org/2018/02/06/2.7.5-released.html

	test_gem_util.rb: fix broken test

	* test/rubygems/test_gem_util.rb: no guarantee that tmpdir is
	  always underneath the root directory at all.

	test_gem_commands_setup_command.rb: BUNDLER_VERS

	* test/rubygems/test_gem_commands_setup_command.rb: run bundled
	  gem command, instead of installed one.

	no need to set bundled bundler unless Gem::USE_BUNDLER_FOR_GEMDEPS


	revert r62302 and force to define the version constant


	Merge RubyGems 2.7.6 from upstream.

	  It fixed some security vulnerabilities.

	  http://blog.rubygems.org/2018/02/15/2.7.6-released.html

	fix regexp literal warning.

	test/rubygems/test_gem_server.rb: eliminate duplicated character class warning.
	[Bug #14481]

	Remove unnecessary `[]`s

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@62837 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

lib/rubygems/package/file_source.rb

@@ -23,11 +23,11 @@ class Gem::Package::FileSource < Gem::Package::Source # :nodoc: all
   end
 
   def with_write_io &block
-    open path, 'wb', &block
+    File.open path, 'wb', &block
   end
 
   def with_read_io &block
-    open path, 'rb', &block
+    File.open path, 'rb', &block
   end
 
 end

lib/rubygems/package/old.rb

@@ -80,7 +80,7 @@ class Gem::Package::Old < Gem::Package
 
         FileUtils.mkdir_p File.dirname destination
 
-        open destination, 'wb', entry['mode'] do |out|
+        File.open destination, 'wb', entry['mode'] do |out|
           out.write file_data
         end
 

lib/rubygems/package/tar_header.rb

@@ -104,25 +104,30 @@ class Gem::Package::TarHeader
     fields = header.unpack UNPACK_FORMAT
 
     new :name     => fields.shift,
-        :mode     => fields.shift.oct,
-        :uid      => fields.shift.oct,
-        :gid      => fields.shift.oct,
-        :size     => fields.shift.oct,
-        :mtime    => fields.shift.oct,
-        :checksum => fields.shift.oct,
+        :mode     => strict_oct(fields.shift),
+        :uid      => strict_oct(fields.shift),
+        :gid      => strict_oct(fields.shift),
+        :size     => strict_oct(fields.shift),
+        :mtime    => strict_oct(fields.shift),
+        :checksum => strict_oct(fields.shift),
         :typeflag => fields.shift,
         :linkname => fields.shift,
         :magic    => fields.shift,
-        :version  => fields.shift.oct,
+        :version  => strict_oct(fields.shift),
         :uname    => fields.shift,
         :gname    => fields.shift,
-        :devmajor => fields.shift.oct,
-        :devminor => fields.shift.oct,
+        :devmajor => strict_oct(fields.shift),
+        :devminor => strict_oct(fields.shift),
         :prefix   => fields.shift,
 
         :empty => empty
   end
 
+  def self.strict_oct(str)
+    return str.oct if str =~ /\A[0-7]*\z/
+    raise ArgumentError, "#{str.inspect} is not an octal string"
+  end
+
   ##
   # Creates a new TarHeader using +vals+
 

lib/rubygems/package/tar_writer.rb

@@ -196,6 +196,8 @@ class Gem::Package::TarWriter
       digest_name == signer.digest_name
     end
 
+    raise "no #{signer.digest_name} in #{digests.values.compact}" unless signature_digest
+
     if signer.key then
       signature = signer.sign signature_digest.digest