warn github will change from git to https

2 files changed, 32 insertions, 1 deletions

diff --git a/lib/bundler/dsl.rb b/lib/bundler/dsl.rb
index b53903b0cf..068c9b252f 100644
--- a/lib/bundler/dsl.rb
+++ b/lib/bundler/dsl.rb
@@ -213,7 +213,13 @@ module Bundler
     def add_git_sources
       git_source(:github) do |repo_name|
         repo_name = "#{repo_name}/#{repo_name}" unless repo_name.include?("/")
-        "git://github.com/#{repo_name}.git"
+        # TODO 2.0 upgrade this setting to the default
+        if Bundler.settings["github.https"]
+          "https://github.com/#{repo_name}.git"
+        else
+          warn_github_source_change(repo_name)
+          "git://github.com/#{repo_name}.git"
+        end
       end
 
       # TODO 2.0 remove this deprecated git source
@@ -371,6 +377,13 @@ module Bundler
       end
     end
 
+    def warn_github_source_change(repo_name)
+      # TODO 2.0 remove deprecation
+      Bundler.ui.deprecate "The :github option uses the git: protocol, which is not secure. " \
+        "Bundler 2.0 will use the https: protcol, which is secure. Enable this change now by " \
+        "running `bundle config github.https true`."
+    end
+
     def warn_deprecated_git_source(name, repo_string)
       # TODO 2.0 remove deprecation
       Bundler.ui.deprecate "The :#{name} git source is deprecated, and will be removed " \
diff --git a/spec/deprecation_spec.rb b/spec/deprecation_spec.rb
index aa818dfe65..d7df05bb43 100644
--- a/spec/deprecation_spec.rb
+++ b/spec/deprecation_spec.rb
@@ -62,6 +62,24 @@ describe "Bundler version 1.99" do
       allow(Bundler::Source::Rubygems).to receive(:new){ @rubygems }
     end
 
+    context "with github gems" do
+      it "warns about the https change" do
+        allow(Bundler.ui).to receive(:deprecate)
+        msg = "The :github option uses the git: protocol, which is not secure. " \
+        "Bundler 2.0 will use the https: protcol, which is secure. Enable this change now by " \
+        "running `bundle config github.https true`."
+        expect(Bundler.ui).to receive(:deprecate).with(msg)
+        subject.gem("sparks", :github => "indirect/sparks")
+      end
+
+      it "upgrades to https on request" do
+        Bundler.settings["github.https"] = true
+        subject.gem("sparks", :github => "indirect/sparks")
+        github_uri = "https://github.com/indirect/sparks.git"
+        expect(subject.dependencies.first.source.uri).to eq(github_uri)
+      end
+    end
+
     context "with bitbucket gems" do
       it "warns about removal" do
         allow(Bundler.ui).to receive(:deprecate)