Support CHECKSUMS for Bundler 2.6 in `rb_bundle_fetch(...)`

[p0deje]

See #16 for original discussion

[p0deje]

This finally landed in Bundler 2.6, a good overview is https://mensfeld.pl/2025/01/the-silent-guardian-why-bundler-checksums-are-a-game-changer-for-your-applications/.

[alexeagle]

Interesting, for my new examples/proto folder and Bundler 2.6.2

CHECKSUMS
  bigdecimal (4.0.1) sha256=8b07d3d065a9f921c80ceaea7c9d4ae596697295b584c296fe599dd0ad01c4a7
  google-protobuf (4.33.4-arm64-darwin) sha256=63bb57e3d7108986f961546a536adaa38bd9ab5b1ebc39a1741a16c6eba3e869
  googleapis-common-protos-types (1.22.0) sha256=f97492b77bd6da0018c860d5004f512fe7cd165554d7019a8f4df6a56fbfc4c7
  grpc (1.76.0-arm64-darwin) sha256=c23f30c2e6a51bb75d8f617b028453e66e09665d8bf571d99c7be1b1f9dd2b59
  grpc-tools (1.76.0) sha256=1b943edf89fd5d125c3476d657b4d89ac85adc6144c5e00a10ed750631f1228e
  rake (13.3.1) sha256=8c9e89d09f66a26a01264e7e3480ec0607f0c497a861ef16063604b1b08eb19c

is the section added to Gemfile.lock by bundle lock --add-checksums

The data in MODULE.bazel is longer

    gem_checksums = {
        "bigdecimal-4.0.1": "8b07d3d065a9f921c80ceaea7c9d4ae596697295b584c296fe599dd0ad01c4a7",
        "google-protobuf-4.33.4": "86921935b023ed0d872d6e84382e79016c91689be0520d614c74426778f13c16",
        "google-protobuf-4.33.4-aarch64-linux-gnu": "7b091ec8a80520738a4dbff59458e2a7ed4304d7fc20fd779b3d019ff52fbead",
        "google-protobuf-4.33.4-aarch64-linux-musl": "c017371e6fe8144285a3dd5d1ae2776f92892f7455bea26537f0f3072b6d894c",
        "google-protobuf-4.33.4-arm64-darwin": "63bb57e3d7108986f961546a536adaa38bd9ab5b1ebc39a1741a16c6eba3e869",
        "google-protobuf-4.33.4-x86-linux-gnu": "c54fab97506b79d6c7857d2caf373df5428c4f318fcffcd7acddc4ee29af383f",
        "google-protobuf-4.33.4-x86-linux-musl": "6e9a67b83e70090f72b65b4386b9273f460cf4f4d6cba61f3b4817bb3b416c97",
        "google-protobuf-4.33.4-x86_64-darwin": "72906abcb572b324eba760b0abdbb827ab781b8e26f718fa3f7f49485295c8d3",
        "google-protobuf-4.33.4-x86_64-linux-gnu": "a8cff953d742bc804ece78bd96e82d88cf65a7d8c1910e045359e2f53074e55d",
        "google-protobuf-4.33.4-x86_64-linux-musl": "265e6e5bbcc0ba1367268739e31c4cc84ff310b56e8d738d2a3245b5cccfc2e7",
        "googleapis-common-protos-types-1.22.0": "f97492b77bd6da0018c860d5004f512fe7cd165554d7019a8f4df6a56fbfc4c7",
        "grpc-1.76.0": "112416fa42153aee440fd1b975de4b2bf746656df071bace97c197a6b5575598",
        "grpc-1.76.0-aarch64-linux-gnu": "25159422ade5690adc1cbefac0d102395378d5aadf143817611e7bd08de06eff",
        "grpc-1.76.0-aarch64-linux-musl": "38ecb67c40ee550723a38d9dfdf676d8d21d81429a5144ce7b78ae896f2e8e53",
        "grpc-1.76.0-arm64-darwin": "c23f30c2e6a51bb75d8f617b028453e66e09665d8bf571d99c7be1b1f9dd2b59",
        "grpc-1.76.0-x86-linux-gnu": "ccd532d55c23e5e8973d86051092d87ce0754b668d4606d4666e36d5db0c6187",
        "grpc-1.76.0-x86-linux-musl": "511a111389d2cbbfef153fa3a0259a535bb87ba231088feb775c9098e19eb7c3",
        "grpc-1.76.0-x86_64-darwin": "60a70eb9c0660d6ea2d79aad26c9aac696b34c3ece36200f292f669d16283bec",
        "grpc-1.76.0-x86_64-linux-gnu": "1561c852903617acae0a9ef9011bcf313054ba65c5528519b002a9f6b4d5c024",
        "grpc-1.76.0-x86_64-linux-musl": "b942a6ae0828e0e696ce26d8b797167314ae7633810c41dd09b45c2176f966cd",
        "grpc-tools-1.76.0": "1b943edf89fd5d125c3476d657b4d89ac85adc6144c5e00a10ed750631f1228e",
        "rake-13.3.1": "8c9e89d09f66a26a01264e7e3480ec0607f0c497a861ef16063604b1b08eb19c",
    },

because we also hash the platform-specific downloads. Is that a missing feature in Bundler?

[alexeagle]

Ah, I see, need to run bundle lock --normalize-platforms too

[p0deje]

rules_ruby never implemented reading from CHECKSUMS section of Gemfile.lock, so for now you still need to use gem_checksums in rb_bundle_fetch

[alexeagle]

Oops I'm sorry, I closed it by mistake imagining that I was the reporter 😅