Fail gracefully when installing a spec where the API is missing deps

6 files changed, 39 insertions, 1 deletions

diff --git a/lib/bundler/endpoint_specification.rb b/lib/bundler/endpoint_specification.rb
index 4f5377d3cc..e60bed9d03 100644
--- a/lib/bundler/endpoint_specification.rb
+++ b/lib/bundler/endpoint_specification.rb
@@ -91,6 +91,11 @@ module Bundler
     end
 
     def __swap__(spec)
+      if (extra_deps = spec.runtime_dependencies.-(dependencies)) && extra_deps.any?
+        raise APIResponseMismatchError,
+          "Downloading #{full_name} revealed dependencies not in the API (#{extra_deps.map(&:to_s).join(", ")})." \
+          "\nInstalling with `--full-index` should fix the problem."
+      end
       @remote_specification = spec
     end
 
diff --git a/lib/bundler/errors.rb b/lib/bundler/errors.rb
index ecd9260ea0..9ef1286936 100644
--- a/lib/bundler/errors.rb
+++ b/lib/bundler/errors.rb
@@ -54,6 +54,7 @@ module Bundler
   class PluginError < BundlerError; status_code(29); end
   class SudoNotPermittedError < BundlerError; status_code(30); end
   class ThreadCreationError < BundlerError; status_code(33); end
+  class APIResponseMismatchError < BundlerError; status_code(34); end
   class GemfileEvalError < GemfileError; end
   class MarshalError < StandardError; end
 
diff --git a/lib/bundler/installer/gem_installer.rb b/lib/bundler/installer/gem_installer.rb
index b6eb221389..0589d14e40 100644
--- a/lib/bundler/installer/gem_installer.rb
+++ b/lib/bundler/installer/gem_installer.rb
@@ -16,7 +16,7 @@ module Bundler
       Bundler.ui.debug "#{worker}:  #{spec.name} (#{spec.version}) from #{spec.loaded_from}"
       generate_executable_stubs
       return true, post_install_message
-    rescue Bundler::InstallHookError, Bundler::SecurityError
+    rescue Bundler::InstallHookError, Bundler::SecurityError, APIResponseMismatchError
       raise
     rescue Errno::ENOSPC
       return false, out_of_space_message
diff --git a/lib/bundler/remote_specification.rb b/lib/bundler/remote_specification.rb
index 112c7f97fe..496e8dcb3a 100644
--- a/lib/bundler/remote_specification.rb
+++ b/lib/bundler/remote_specification.rb
@@ -50,6 +50,11 @@ module Bundler
     # once the remote gem is downloaded, the backend specification will
     # be swapped out.
     def __swap__(spec)
+      if (extra_deps = spec.runtime_dependencies.-(dependencies)) && extra_deps.any?
+        raise APIResponseMismatchError,
+          "Downloading #{full_name} revealed dependencies not in the API (#{extra_deps.map(&:to_s).join(", ")})." \
+          "\nInstalling with `--full-index` should fix the problem."
+      end
       @_remote_specification = spec
     end
 
diff --git a/spec/install/gems/compact_index_spec.rb b/spec/install/gems/compact_index_spec.rb
index 12f82e9063..3f39e420b7 100644
--- a/spec/install/gems/compact_index_spec.rb
+++ b/spec/install/gems/compact_index_spec.rb
@@ -753,4 +753,15 @@ The checksum of /versions does not match the checksum provided by the server! So
       gem "rack"
     G
   end
+
+  it "doesn't explode when the API dependencies are wrong" do
+    install_gemfile <<-G, :artifice => "compact_index_wrong_dependencies"
+      source "#{source_uri}"
+      gem "rails"
+    G
+    expect(out).to end_with(<<-E.strip)
+Downloading rails-2.3.2 revealed dependencies not in the API (rake (= 10.0.2), actionpack (= 2.3.2), activerecord (= 2.3.2), actionmailer (= 2.3.2), activeresource (= 2.3.2)).
+Installing with `--full-index` should fix the problem.
+    E
+  end
 end
diff --git a/spec/support/artifice/compact_index_wrong_dependencies.rb b/spec/support/artifice/compact_index_wrong_dependencies.rb
new file mode 100644
index 0000000000..25935f5e5d
--- /dev/null
+++ b/spec/support/artifice/compact_index_wrong_dependencies.rb
@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+require File.expand_path("../compact_index", __FILE__)
+
+Artifice.deactivate
+
+class CompactIndexWrongDependencies < CompactIndexAPI
+  get "/info/:name" do
+    etag_response do
+      gem = gems.find {|g| g.name == params[:name] }
+      gem.versions.each {|gv| gv.dependencies.clear } if gem
+      CompactIndex.info(gem ? gem.versions : [])
+    end
+  end
+end
+
+Artifice.activate_with(CompactIndexWrongDependencies)