[rubygems/rubygems] Refactor to checksums stored via source

This gets the specs passing, and handles the fact that we expect
checkums to be pinned only to a particular source

This also avoids reading in .gem files during lockfile generation,
instead allowing us to query the source for each resolved gem to grab
the checksum

Finally, this opens up a route to having user-stored checksum databases,
similar to how other package managers do this!

Add checksums to dev lockfiles

Handle full name conflicts from different original_platforms when adding checksums to store from compact index

Specs passing on Bundler 3

https://github.com/rubygems/rubygems/commit/86c7084e1c

1 files changed, 11 insertions, 1 deletions

diff --git a/lib/bundler/endpoint_specification.rb b/lib/bundler/endpoint_specification.rb
index 863544b1f9..943e33be94 100644
--- a/lib/bundler/endpoint_specification.rb
+++ b/lib/bundler/endpoint_specification.rb
@@ -125,7 +125,17 @@ module Bundler
         next unless v
         case k.to_s
         when "checksum"
-          @checksum = v.last
+          next if Bundler.settings[:disable_checksum_validation]
+          digest = v.last
+          if digest.length == 64
+            # nothing to do, it's a hexdigest
+          elsif digest.length == 44
+            # transform the bytes from base64 to hex
+            digest = digest.unpack("m0").first.unpack("H*").first
+          else
+            raise ArgumentError, "The given checksum for #{full_name} (#{digest.inspect}) is not a valid SHA256 hexdigest nor base64digest"
+          end
+          @checksum = Checksum::Single.new("sha256", digest, "API response from #{@spec_fetcher.uri}")
         when "rubygems"
           @required_rubygems_version = Gem::Requirement.new(v)
         when "ruby"