warn github will change from git to https

2 files changed, 32 insertions, 1 deletions

diff --git a/lib/bundler/dsl.rb b/lib/bundler/dsl.rb
index 6cd95dd63c..6b07e5bea2 100644
--- a/lib/bundler/dsl.rb
+++ b/lib/bundler/dsl.rb
@@ -265,7 +265,13 @@ module Bundler
         #     "https://github.com/#{repo_name}.git"
         #   end
         repo_name = "#{repo_name}/#{repo_name}" unless repo_name.include?("/")
-        "git://github.com/#{repo_name}.git"
+        # TODO: 2.0 upgrade this setting to the default
+        if Bundler.settings["github.https"]
+          "https://github.com/#{repo_name}.git"
+        else
+          warn_github_source_change(repo_name)
+          "git://github.com/#{repo_name}.git"
+        end
       end
 
       # TODO: 2.0 remove this deprecated git source
@@ -424,6 +430,13 @@ module Bundler
       end
     end
 
+    def warn_github_source_change(repo_name)
+      # TODO: 2.0 remove deprecation
+      Bundler.ui.deprecate "The :github option uses the git: protocol, which is not secure. " \
+        "Bundler 2.0 will use the https: protcol, which is secure. Enable this change now by " \
+        "running `bundle config github.https true`."
+    end
+
     def warn_deprecated_git_source(name, repo_string)
       # TODO: 2.0 remove deprecation
       Bundler.ui.deprecate "The :#{name} git source is deprecated, and will be removed " \
diff --git a/spec/deprecation_spec.rb b/spec/deprecation_spec.rb
index d7fd228f6c..a559b5d995 100644
--- a/spec/deprecation_spec.rb
+++ b/spec/deprecation_spec.rb
@@ -63,6 +63,24 @@ describe "Bundler version 1.99" do
       allow(Bundler::Source::Rubygems).to receive(:new) { @rubygems }
     end
 
+    context "with github gems" do
+      it "warns about the https change" do
+        allow(Bundler.ui).to receive(:deprecate)
+        msg = "The :github option uses the git: protocol, which is not secure. " \
+        "Bundler 2.0 will use the https: protcol, which is secure. Enable this change now by " \
+        "running `bundle config github.https true`."
+        expect(Bundler.ui).to receive(:deprecate).with(msg)
+        subject.gem("sparks", :github => "indirect/sparks")
+      end
+
+      it "upgrades to https on request" do
+        Bundler.settings["github.https"] = true
+        subject.gem("sparks", :github => "indirect/sparks")
+        github_uri = "https://github.com/indirect/sparks.git"
+        expect(subject.dependencies.first.source.uri).to eq(github_uri)
+      end
+    end
+
     context "with bitbucket gems" do
       it "warns about removal" do
         allow(Bundler.ui).to receive(:deprecate)