[rubygems/rubygems] Enable checksums on Bundler 3 for fresh lockfiles

And get specs passing.

https://github.com/rubygems/rubygems/commit/c23b5f5b84

lib/bundler/definition.rb

@@ -115,7 +115,7 @@ module Bundler
         @originally_locked_specs = @locked_specs
         @locked_sources = []
         @locked_platforms = []
-        @locked_checksums = nil
+        @locked_checksums = Bundler.feature_flag.bundler_3_mode?
       end
 
       locked_gem_sources = @locked_sources.select {|s| s.is_a?(Source::Rubygems) }

spec/bundler/bundler/definition_spec.rb

@@ -53,7 +53,7 @@ RSpec.describe Bundler::Definition do
         s.add_dependency "myrack", "1.0"
       end
 
-      checksums = checksums_section_when_existing do |c|
+      checksums = checksums_section_when_enabled do |c|
         c.no_checksum "foo", "1.0"
         c.checksum gem_repo1, "myrack", "1.0.0"
       end
@@ -108,7 +108,7 @@ RSpec.describe Bundler::Definition do
         s.add_development_dependency "net-ssh", "1.0"
       end
 
-      checksums = checksums_section_when_existing do |c|
+      checksums = checksums_section_when_enabled do |c|
         c.no_checksum "foo", "1.0"
         c.checksum gem_repo1, "myrack", "1.0.0"
       end
@@ -149,15 +149,15 @@ RSpec.describe Bundler::Definition do
     end
 
     it "for a locked gem for another platform" do
-      checksums = checksums_section_when_existing do |c|
-        c.no_checksum "only_java", "1.1", "java"
-      end
-
       install_gemfile <<-G
         source "https://gem.repo1"
         gem "only_java", platform: :jruby
       G
 
+      checksums = checksums_section_when_enabled do |c|
+        c.checksum gem_repo1, "only_java", "1.1", "java"
+      end
+
       bundle "lock --add-platform java"
       bundle :check, env: { "DEBUG" => "1" }
 
@@ -180,7 +180,7 @@ RSpec.describe Bundler::Definition do
     end
 
     it "for a rubygems gem" do
-      checksums = checksums_section_when_existing do |c|
+      checksums = checksums_section_when_enabled do |c|
         c.checksum gem_repo1, "foo", "1.0"
       end
 

spec/bundler/cache/gems_spec.rb

@@ -297,6 +297,7 @@ RSpec.describe "bundle cache" do
 
       simulate_new_machine
 
+      FileUtils.rm bundled_app_lock
       bundle :install, raise_on_error: false
 
       expect(err).to eq <<~E.strip

spec/bundler/commands/check_spec.rb

@@ -407,7 +407,7 @@ RSpec.describe "bundle check" do
       system_gems "depends_on_myrack-1.0", "myrack-1.0", gem_repo: gem_repo4, path: default_bundle_path
       bundle :check
 
-      checksums = checksums_section_when_existing do |c|
+      checksums = checksums_section_when_enabled do |c|
         c.no_checksum "depends_on_myrack", "1.0"
         c.no_checksum "myrack", "1.0"
       end
@@ -470,13 +470,15 @@ RSpec.describe "bundle check" do
 
       bundle "check --verbose", dir: tmp("bundle-check-issue")
 
-      checksums = checksums_section_when_existing do |c|
+      lockfile = File.read(tmp("bundle-check-issue/Gemfile.lock"))
+
+      checksums = checksums_section_when_enabled(lockfile) do |c|
         c.checksum gem_repo4, "awesome_print", "1.0"
         c.no_checksum "bundle-check-issue", "9999"
         c.checksum gem_repo2, "dex-dispatch-engine", "1.0"
       end
 
-      expect(File.read(tmp("bundle-check-issue/Gemfile.lock"))).to eq <<~L
+      expect(lockfile).to eq <<~L
         PATH
           remote: .
           specs:

spec/bundler/commands/install_spec.rb

@@ -674,7 +674,7 @@ RSpec.describe "bundle install with gem sources" do
       end
 
       it "writes current Ruby version to Gemfile.lock" do
-        checksums = checksums_section_when_existing
+        checksums = checksums_section_when_enabled
         expect(lockfile).to eq <<~L
          GEM
            remote: https://gem.repo1/
@@ -699,7 +699,7 @@ RSpec.describe "bundle install with gem sources" do
           source "https://gem.repo1"
         G
 
-        checksums = checksums_section_when_existing
+        checksums = checksums_section_when_enabled
 
         expect(lockfile).to eq <<~L
          GEM
@@ -1249,7 +1249,7 @@ RSpec.describe "bundle install with gem sources" do
         bundle "install", artifice: "compact_index"
       end
 
-      checksums = checksums_section_when_existing do |c|
+      checksums = checksums_section_when_enabled do |c|
         c.checksum gem_repo4, "crass", "1.0.6"
         c.checksum gem_repo4, "loofah", "2.12.0"
         c.checksum gem_repo4, "nokogiri", "1.12.4", "x86_64-darwin"

spec/bundler/commands/lock_spec.rb

@@ -1,31 +1,22 @@
 # frozen_string_literal: true
 
 RSpec.describe "bundle lock" do
-  before :each do
-    build_repo2
-
-    gemfile <<-G
-      source "https://gem.repo2"
-      gem "rails"
-      gem "weakling"
-      gem "foo"
-    G
-
-    checksums = checksums_section_when_existing do |c|
-      c.checksum gem_repo2, "actionmailer", "2.3.2"
-      c.checksum gem_repo2, "actionpack", "2.3.2"
-      c.checksum gem_repo2, "activerecord", "2.3.2"
-      c.checksum gem_repo2, "activeresource", "2.3.2"
-      c.checksum gem_repo2, "activesupport", "2.3.2"
-      c.checksum gem_repo2, "foo", "1.0"
-      c.checksum gem_repo2, "rails", "2.3.2"
-      c.checksum gem_repo2, "rake", rake_version
-      c.checksum gem_repo2, "weakling", "0.0.3"
+  let(:expected_lockfile) do
+    checksums = checksums_section_when_enabled do |c|
+      c.checksum gem_repo4, "actionmailer", "2.3.2"
+      c.checksum gem_repo4, "actionpack", "2.3.2"
+      c.checksum gem_repo4, "activerecord", "2.3.2"
+      c.checksum gem_repo4, "activeresource", "2.3.2"
+      c.checksum gem_repo4, "activesupport", "2.3.2"
+      c.checksum gem_repo4, "foo", "1.0"
+      c.checksum gem_repo4, "rails", "2.3.2"
+      c.checksum gem_repo4, "rake", rake_version
+      c.checksum gem_repo4, "weakling", "0.0.3"
     end
 
-    @lockfile = <<~L
+    <<~L
       GEM
-        remote: https://gem.repo2/
+        remote: https://gem.repo4/
         specs:
           actionmailer (2.3.2)
             activesupport (= 2.3.2)
@@ -59,44 +50,136 @@ RSpec.describe "bundle lock" do
     L
   end
 
+  let(:outdated_lockfile) do
+    checksums = checksums_section_when_enabled do |c|
+      c.checksum gem_repo4, "actionmailer", "2.3.1"
+      c.checksum gem_repo4, "actionpack", "2.3.1"
+      c.checksum gem_repo4, "activerecord", "2.3.1"
+      c.checksum gem_repo4, "activeresource", "2.3.1"
+      c.checksum gem_repo4, "activesupport", "2.3.1"
+      c.checksum gem_repo4, "foo", "1.0"
+      c.checksum gem_repo4, "rails", "2.3.1"
+      c.checksum gem_repo4, "rake", rake_version
+      c.checksum gem_repo4, "weakling", "0.0.3"
+    end
+
+    <<~L
+      GEM
+        remote: https://gem.repo4/
+        specs:
+          actionmailer (2.3.1)
+            activesupport (= 2.3.1)
+          actionpack (2.3.1)
+            activesupport (= 2.3.1)
+          activerecord (2.3.1)
+            activesupport (= 2.3.1)
+          activeresource (2.3.1)
+            activesupport (= 2.3.1)
+          activesupport (2.3.1)
+          foo (1.0)
+          rails (2.3.1)
+            actionmailer (= 2.3.1)
+            actionpack (= 2.3.1)
+            activerecord (= 2.3.1)
+            activeresource (= 2.3.1)
+            rake (= #{rake_version})
+          rake (#{rake_version})
+          weakling (0.0.3)
+
+      PLATFORMS
+        #{lockfile_platforms}
+
+      DEPENDENCIES
+        foo
+        rails
+        weakling
+      #{checksums}
+      BUNDLED WITH
+         #{Bundler::VERSION}
+    L
+  end
+
+  before :each do
+    build_repo4 do
+      FileUtils.cp rake_path, "#{gem_repo4}/gems/"
+
+      build_gem "rake", "10.0.1"
+
+      %w[2.3.1 2.3.2].each do |version|
+        build_gem "rails", version do |s|
+          s.executables = "rails"
+          s.add_dependency "rake",           version == "2.3.1" ? "10.0.1" : rake_version
+          s.add_dependency "actionpack",     version
+          s.add_dependency "activerecord",   version
+          s.add_dependency "actionmailer",   version
+          s.add_dependency "activeresource", version
+        end
+        build_gem "actionpack", version do |s|
+          s.add_dependency "activesupport", version
+        end
+        build_gem "activerecord", version do |s|
+          s.add_dependency "activesupport", version
+        end
+        build_gem "actionmailer", version do |s|
+          s.add_dependency "activesupport", version
+        end
+        build_gem "activeresource", version do |s|
+          s.add_dependency "activesupport", version
+        end
+        build_gem "activesupport", version
+      end
+
+      build_gem "weakling", "0.0.3"
+
+      build_gem "foo"
+    end
+
+    gemfile <<-G
+      source "https://gem.repo4"
+      gem "rails"
+      gem "weakling"
+      gem "foo"
+    G
+  end
+
   it "prints a lockfile when there is no existing lockfile with --print" do
     bundle "lock --print"
 
-    expect(out).to eq(@lockfile.chomp)
+    expect(out).to eq(expected_lockfile.chomp)
   end
 
   it "prints a lockfile when there is an existing lockfile with --print" do
-    lockfile remove_checksums_section_from_lockfile(@lockfile)
+    lockfile expected_lockfile
 
     bundle "lock --print"
 
-    expect(out).to eq(remove_checksums_section_from_lockfile(@lockfile).chomp)
+    expect(out).to eq(expected_lockfile.chomp)
   end
 
   it "prints a lockfile when there is an existing checksums lockfile with --print" do
-    lockfile @lockfile
+    lockfile expected_lockfile
 
     bundle "lock --print"
 
-    expect(out).to eq(@lockfile.chomp)
+    expect(out).to eq(expected_lockfile.chomp)
   end
 
   it "writes a lockfile when there is no existing lockfile" do
     bundle "lock"
 
-    expect(read_lockfile).to eq(@lockfile)
+    expect(read_lockfile).to eq(expected_lockfile)
   end
 
   it "prints a lockfile without fetching new checksums if the existing lockfile had no checksums" do
-    lockfile remove_checksums_from_lockfile(@lockfile)
+    lockfile expected_lockfile
 
     bundle "lock --print"
 
-    expect(out).to eq(remove_checksums_from_lockfile(@lockfile).chomp)
+    expect(out).to eq(expected_lockfile.chomp)
   end
 
   it "touches the lockfile when there is an existing lockfile that does not need changes" do
-    lockfile @lockfile
+    lockfile expected_lockfile
 
     expect do
       bundle "lock"
@@ -104,7 +187,7 @@ RSpec.describe "bundle lock" do
   end
 
   it "does not touch lockfile with --print" do
-    lockfile @lockfile
+    lockfile expected_lockfile
 
     expect do
       bundle "lock --print"
@@ -112,27 +195,19 @@ RSpec.describe "bundle lock" do
   end
 
   it "writes a lockfile when there is an outdated lockfile using --update" do
-    lockfile remove_checksums_from_lockfile(@lockfile.gsub("2.3.2", "2.3.1"), " (2.3.1)")
+    lockfile outdated_lockfile
 
     bundle "lock --update"
 
-    expect(read_lockfile).to eq(remove_checksums_from_lockfile(@lockfile))
-  end
-
-  it "writes a lockfile with checksums on --update when checksums exist" do
-    lockfile @lockfile.gsub("2.3.2", "2.3.1")
-
-    bundle "lock --update"
-
-    expect(read_lockfile).to eq(@lockfile)
+    expect(read_lockfile).to eq(expected_lockfile)
   end
 
   it "writes a lockfile when there is an outdated lockfile and bundle is frozen" do
-    lockfile @lockfile.gsub("2.3.2", "2.3.1")
+    lockfile outdated_lockfile
 
     bundle "lock --update", env: { "BUNDLE_FROZEN" => "true" }
 
-    expect(read_lockfile).to eq(@lockfile)
+    expect(read_lockfile).to eq(expected_lockfile)
   end
 
   it "does not fetch remote specs when using the --local option" do
@@ -142,26 +217,27 @@ RSpec.describe "bundle lock" do
   end
 
   it "does not fetch remote checksums with --local" do
-    lockfile remove_checksums_from_lockfile(@lockfile)
+    lockfile expected_lockfile
 
     bundle "lock --print --local"
 
-    # No checksums because --local prevents fetching them
-    expect(out).to eq(remove_checksums_from_lockfile(@lockfile).chomp)
+    expect(out).to eq(expected_lockfile.chomp)
   end
 
   it "works with --gemfile flag" do
     gemfile "CustomGemfile", <<-G
-      source "https://gem.repo2"
+      source "https://gem.repo4"
       gem "foo"
     G
-    checksums = checksums_section_when_existing do |c|
-      c.no_checksum "foo", "1.0"
+    bundle "lock --gemfile CustomGemfile"
+
+    checksums = checksums_section_when_enabled do |c|
+      c.checksum gem_repo4, "foo", "1.0"
     end
 
     lockfile = <<~L
       GEM
-        remote: https://gem.repo2/
+        remote: https://gem.repo4/
         specs:
           foo (1.0)
 
@@ -174,8 +250,6 @@ RSpec.describe "bundle lock" do
       BUNDLED WITH
          #{Bundler::VERSION}
     L
-    bundle "lock --gemfile CustomGemfile"
-
     expect(out).to match(/Writing lockfile to.+CustomGemfile\.lock/)
     expect(read_lockfile("CustomGemfile.lock")).to eq(lockfile)
     expect { read_lockfile }.to raise_error(Errno::ENOENT)
@@ -185,7 +259,7 @@ RSpec.describe "bundle lock" do
     bundle "lock --lockfile=lock"
 
     expect(out).to match(/Writing lockfile to.+lock/)
-    expect(read_lockfile("lock")).to eq(remove_checksums_from_lockfile(@lockfile))
+    expect(read_lockfile("lock")).to eq(expected_lockfile)
     expect { read_lockfile }.to raise_error(Errno::ENOENT)
   end
 
@@ -193,21 +267,21 @@ RSpec.describe "bundle lock" do
     bundle "install"
     bundle "lock --lockfile=lock"
 
-    checksums = checksums_section_when_existing do |c|
-      c.checksum gem_repo2, "actionmailer", "2.3.2"
-      c.checksum gem_repo2, "actionpack", "2.3.2"
-      c.checksum gem_repo2, "activerecord", "2.3.2"
-      c.checksum gem_repo2, "activeresource", "2.3.2"
-      c.checksum gem_repo2, "activesupport", "2.3.2"
-      c.checksum gem_repo2, "foo", "1.0"
-      c.checksum gem_repo2, "rails", "2.3.2"
-      c.checksum gem_repo2, "rake", rake_version
-      c.checksum gem_repo2, "weakling", "0.0.3"
+    checksums = checksums_section_when_enabled do |c|
+      c.checksum gem_repo4, "actionmailer", "2.3.2"
+      c.checksum gem_repo4, "actionpack", "2.3.2"
+      c.checksum gem_repo4, "activerecord", "2.3.2"
+      c.checksum gem_repo4, "activeresource", "2.3.2"
+      c.checksum gem_repo4, "activesupport", "2.3.2"
+      c.checksum gem_repo4, "foo", "1.0"
+      c.checksum gem_repo4, "rails", "2.3.2"
+      c.checksum gem_repo4, "rake", rake_version
+      c.checksum gem_repo4, "weakling", "0.0.3"
     end
 
     lockfile = <<~L
       GEM
-        remote: https://gem.repo2/
+        remote: https://gem.repo4/
         specs:
           actionmailer (2.3.2)
             activesupport (= 2.3.2)
@@ -245,11 +319,58 @@ RSpec.describe "bundle lock" do
   end
 
   it "update specific gems using --update" do
-    lockfile @lockfile.gsub("2.3.2", "2.3.1").gsub(rake_version, "10.0.1")
+    checksums = checksums_section_when_enabled do |c|
+      c.checksum gem_repo4, "actionmailer", "2.3.1"
+      c.checksum gem_repo4, "actionpack", "2.3.1"
+      c.checksum gem_repo4, "activerecord", "2.3.1"
+      c.checksum gem_repo4, "activeresource", "2.3.1"
+      c.checksum gem_repo4, "activesupport", "2.3.1"
+      c.checksum gem_repo4, "foo", "1.0"
+      c.checksum gem_repo4, "rails", "2.3.1"
+      c.checksum gem_repo4, "rake", "10.0.1"
+      c.checksum gem_repo4, "weakling", "0.0.3"
+    end
+
+    lockfile_with_outdated_rails_and_rake = <<~L
+      GEM
+        remote: https://gem.repo4/
+        specs:
+          actionmailer (2.3.1)
+            activesupport (= 2.3.1)
+          actionpack (2.3.1)
+            activesupport (= 2.3.1)
+          activerecord (2.3.1)
+            activesupport (= 2.3.1)
+          activeresource (2.3.1)
+            activesupport (= 2.3.1)
+          activesupport (2.3.1)
+          foo (1.0)
+          rails (2.3.1)
+            actionmailer (= 2.3.1)
+            actionpack (= 2.3.1)
+            activerecord (= 2.3.1)
+            activeresource (= 2.3.1)
+            rake (= 10.0.1)
+          rake (10.0.1)
+          weakling (0.0.3)
+
+      PLATFORMS
+        #{lockfile_platforms}
+
+      DEPENDENCIES
+        foo
+        rails
+        weakling
+      #{checksums}
+      BUNDLED WITH
+         #{Bundler::VERSION}
+    L
+
+    lockfile lockfile_with_outdated_rails_and_rake
 
     bundle "lock --update rails rake"
 
-    expect(read_lockfile).to eq(remove_checksums_from_lockfile(@lockfile, "(2.3.2)", "(#{rake_version})"))
+    expect(read_lockfile).to eq(expected_lockfile)
   end
 
   it "updates specific gems using --update, even if that requires unlocking other top level gems" do
@@ -375,7 +496,7 @@ RSpec.describe "bundle lock" do
   end
 
   it "preserves unknown checksum algorithms" do
-    lockfile @lockfile.gsub(/(sha256=[a-f0-9]+)$/, "constant=true,\\1,xyz=123")
+    lockfile expected_lockfile.gsub(/(sha256=[a-f0-9]+)$/, "constant=true,\\1,xyz=123")
 
     previous_lockfile = read_lockfile
 
@@ -441,12 +562,12 @@ RSpec.describe "bundle lock" do
   end
 
   it "errors when updating a missing specific gems using --update" do
-    lockfile @lockfile
+    lockfile expected_lockfile
 
     bundle "lock --update blahblah", raise_on_error: false
     expect(err).to eq("Could not find gem 'blahblah'.")
 
-    expect(read_lockfile).to eq(@lockfile)
+    expect(read_lockfile).to eq(expected_lockfile)
   end
 
   it "can lock without downloading gems" do
@@ -743,7 +864,7 @@ RSpec.describe "bundle lock" do
       end
     end
 
-    checksums = checksums_section_when_existing do |c|
+    checksums = checksums_section_when_enabled do |c|
       c.checksum gem_repo4, "nokogiri", "1.12.0"
       c.checksum gem_repo4, "nokogiri", "1.12.0", "x86_64-darwin"
     end
@@ -839,15 +960,15 @@ RSpec.describe "bundle lock" do
       gem "gssapi"
     G
 
-    checksums = checksums_section_when_existing do |c|
-      c.no_checksum "ffi", "1.9.14", "x86-mingw32"
-      c.no_checksum "gssapi", "1.2.0"
-      c.no_checksum "mixlib-shellout", "2.2.6", "universal-mingw32"
-      c.no_checksum "win32-process", "0.8.3"
-    end
-
     simulate_platform(x86_mingw32) { bundle :lock }
 
+    checksums = checksums_section_when_enabled do |c|
+      c.checksum gem_repo4, "ffi", "1.9.14", "x86-mingw32"
+      c.checksum gem_repo4, "gssapi", "1.2.0"
+      c.checksum gem_repo4, "mixlib-shellout", "2.2.6", "universal-mingw32"
+      c.checksum gem_repo4, "win32-process", "0.8.3"
+    end
+
     expect(lockfile).to eq <<~G
       GEM
         remote: https://gem.repo4/
@@ -874,8 +995,8 @@ RSpec.describe "bundle lock" do
     bundle "config set --local force_ruby_platform true"
     bundle :lock
 
-    checksums.no_checksum "ffi", "1.9.14"
-    checksums.no_checksum "mixlib-shellout", "2.2.6"
+    checksums.checksum gem_repo4, "ffi", "1.9.14"
+    checksums.checksum gem_repo4, "mixlib-shellout", "2.2.6"
 
     expect(lockfile).to eq <<~G
       GEM
@@ -964,9 +1085,9 @@ RSpec.describe "bundle lock" do
 
     simulate_platform(Gem::Platform.new("x86_64-darwin-19")) { bundle "lock" }
 
-    checksums = checksums_section_when_existing do |c|
-      c.no_checksum "libv8", "8.4.255.0", "x86_64-darwin-19"
-      c.no_checksum "libv8", "8.4.255.0", "x86_64-darwin-20"
+    checksums = checksums_section_when_enabled do |c|
+      c.checksum gem_repo4, "libv8", "8.4.255.0", "x86_64-darwin-19"
+      c.checksum gem_repo4, "libv8", "8.4.255.0", "x86_64-darwin-20"
     end
 
     expect(lockfile).to eq <<~G
@@ -999,7 +1120,7 @@ RSpec.describe "bundle lock" do
       end
     end
 
-    checksums = checksums_section_when_existing do |c|
+    checksums = checksums_section_when_enabled do |c|
       c.checksum gem_repo4, "libv8", "8.4.255.0", "x86_64-darwin-19"
       c.checksum gem_repo4, "libv8", "8.4.255.0", "x86_64-darwin-20"
     end
@@ -1232,31 +1353,31 @@ RSpec.describe "bundle lock" do
 
   context "when an update is available" do
     before do
-      build_repo2 do
+      update_repo4 do
         build_gem "foo", "2.0"
       end
 
-      lockfile(@lockfile)
+      lockfile(expected_lockfile)
     end
 
     it "does not implicitly update" do
       bundle "lock"
 
-      checksums = checksums_section_when_existing do |c|
-        c.checksum gem_repo2, "actionmailer", "2.3.2"
-        c.checksum gem_repo2, "actionpack", "2.3.2"
-        c.checksum gem_repo2, "activerecord", "2.3.2"
-        c.checksum gem_repo2, "activeresource", "2.3.2"
-        c.checksum gem_repo2, "activesupport", "2.3.2"
-        c.checksum gem_repo2, "foo", "1.0"
-        c.checksum gem_repo2, "rails", "2.3.2"
-        c.checksum gem_repo2, "rake", rake_version
-        c.checksum gem_repo2, "weakling", "0.0.3"
+      checksums = checksums_section_when_enabled do |c|
+        c.checksum gem_repo4, "actionmailer", "2.3.2"
+        c.checksum gem_repo4, "actionpack", "2.3.2"
+        c.checksum gem_repo4, "activerecord", "2.3.2"
+        c.checksum gem_repo4, "activeresource", "2.3.2"
+        c.checksum gem_repo4, "activesupport", "2.3.2"
+        c.checksum gem_repo4, "foo", "1.0"
+        c.checksum gem_repo4, "rails", "2.3.2"
+        c.checksum gem_repo4, "rake", rake_version
+        c.checksum gem_repo4, "weakling", "0.0.3"
       end
 
       expected_lockfile = <<~L
         GEM
-          remote: https://gem.repo2/
+          remote: https://gem.repo4/
           specs:
             actionmailer (2.3.2)
               activesupport (= 2.3.2)
@@ -1296,21 +1417,21 @@ RSpec.describe "bundle lock" do
       gemfile gemfile.gsub('"foo"', '"foo", "2.0"')
       bundle "lock"
 
-      checksums = checksums_section_when_existing do |c|
-        c.checksum gem_repo2, "actionmailer", "2.3.2"
-        c.checksum gem_repo2, "actionpack", "2.3.2"
-        c.checksum gem_repo2, "activerecord", "2.3.2"
-        c.checksum gem_repo2, "activeresource", "2.3.2"
-        c.checksum gem_repo2, "activesupport", "2.3.2"
-        c.no_checksum "foo", "2.0"
-        c.checksum gem_repo2, "rails", "2.3.2"
-        c.checksum gem_repo2, "rake", rake_version
-        c.checksum gem_repo2, "weakling", "0.0.3"
+      checksums = checksums_section_when_enabled do |c|
+        c.checksum gem_repo4, "actionmailer", "2.3.2"
+        c.checksum gem_repo4, "actionpack", "2.3.2"
+        c.checksum gem_repo4, "activerecord", "2.3.2"
+        c.checksum gem_repo4, "activeresource", "2.3.2"
+        c.checksum gem_repo4, "activesupport", "2.3.2"
+        c.checksum gem_repo4, "foo", "2.0"
+        c.checksum gem_repo4, "rails", "2.3.2"
+        c.checksum gem_repo4, "rake", rake_version
+        c.checksum gem_repo4, "weakling", "0.0.3"
       end
 
       expected_lockfile = <<~L
         GEM
-          remote: https://gem.repo2/
+          remote: https://gem.repo4/
           specs:
             actionmailer (2.3.2)
               activesupport (= 2.3.2)
@@ -1374,7 +1495,7 @@ RSpec.describe "bundle lock" do
         gem "debug"
       G
 
-      checksums = checksums_section_when_existing do |c|
+      checksums = checksums_section_when_enabled do |c|
         c.checksum gem_repo4, "debug", "1.6.3"
         c.checksum gem_repo4, "irb", "1.5.0"
       end
@@ -1677,7 +1798,7 @@ RSpec.describe "bundle lock" do
     end
 
     it "locks ruby specs" do
-      checksums = checksums_section_when_existing do |c|
+      checksums = checksums_section_when_enabled do |c|
         c.no_checksum "foo", "1.0"
         c.no_checksum "nokogiri", "1.14.2"
       end
@@ -1765,7 +1886,7 @@ RSpec.describe "bundle lock" do
     end
 
     it "does not downgrade top level dependencies" do
-      checksums = checksums_section_when_existing do |c|
+      checksums = checksums_section_when_enabled do |c|
         c.no_checksum "actionpack", "7.0.4.3"
         c.no_checksum "activesupport", "7.0.4.3"
         c.no_checksum "govuk_app_config", "4.13.0"

spec/bundler/commands/update_spec.rb

@@ -275,7 +275,7 @@ RSpec.describe "bundle update" do
         gem "countries"
       G
 
-      checksums = checksums_section_when_existing do |c|
+      checksums = checksums_section_when_enabled do |c|
         c.checksum(gem_repo4, "countries", "3.1.0")
         c.checksum(gem_repo4, "country_select", "5.1.0")
       end
@@ -510,7 +510,7 @@ RSpec.describe "bundle update" do
 
       original_lockfile = lockfile
 
-      checksums = checksums_section_when_existing do |c|
+      checksums = checksums_section_when_enabled do |c|
         c.checksum gem_repo4, "activesupport", "6.0.4.1"
         c.checksum gem_repo4, "tzinfo", "1.2.9"
       end
@@ -537,10 +537,6 @@ RSpec.describe "bundle update" do
       expect(the_bundle).to include_gems("activesupport 6.0.4.1", "tzinfo 1.2.9")
       expect(lockfile).to eq(expected_lockfile)
 
-      # needed because regressing to versions already present on the system
-      # won't add a checksum
-      expected_lockfile = remove_checksums_from_lockfile(expected_lockfile)
-
       lockfile original_lockfile
       bundle "update"
       expect(the_bundle).to include_gems("activesupport 6.0.4.1", "tzinfo 1.2.9")
@@ -1249,7 +1245,7 @@ RSpec.describe "bundle update --ruby" do
          #{lockfile_platforms}
 
        DEPENDENCIES
-
+       #{checksums_section_when_enabled}
        BUNDLED WITH
           #{Bundler::VERSION}
       L
@@ -1281,7 +1277,7 @@ RSpec.describe "bundle update --ruby" do
           #{lockfile_platforms}
 
         DEPENDENCIES
-
+        #{checksums_section_when_enabled}
         RUBY VERSION
            #{Bundler::RubyVersion.system}
 
@@ -1369,7 +1365,7 @@ RSpec.describe "bundle update --bundler" do
       build_gem "myrack", "1.0"
     end
 
-    checksums = checksums_section_when_existing do |c|
+    checksums = checksums_section_when_enabled do |c|
       c.checksum(gem_repo4, "myrack", "1.0")
     end
 
@@ -1428,7 +1424,7 @@ RSpec.describe "bundle update --bundler" do
     G
     lockfile lockfile.sub(/(^\s*)#{Bundler::VERSION}($)/, "2.3.9")
 
-    checksums = checksums_section_when_existing do |c|
+    checksums = checksums_section_when_enabled do |c|
       c.checksum(gem_repo4, "myrack", "1.0")
     end
 
@@ -1623,7 +1619,7 @@ RSpec.describe "bundle update --bundler" do
 
     # Only updates properly on modern RubyGems.
     if Gem.rubygems_version >= Gem::Version.new("3.3.0.dev")
-      checksums = checksums_section_when_existing do |c|
+      checksums = checksums_section_when_enabled do |c|
         c.checksum(gem_repo4, "myrack", "1.0")
       end
 
@@ -1664,7 +1660,7 @@ RSpec.describe "bundle update --bundler" do
     expect(out).not_to include("Fetching gem metadata from https://rubygems.org/")
 
     # Only updates properly on modern RubyGems.
-    checksums = checksums_section_when_existing do |c|
+    checksums = checksums_section_when_enabled do |c|
       c.checksum(gem_repo4, "myrack", "1.0")
     end
 
@@ -1905,7 +1901,7 @@ RSpec.describe "bundle update conservative" do
     it "should only change direct dependencies when updating the lockfile with --conservative" do
       bundle "lock --update --conservative"
 
-      checksums = checksums_section_when_existing do |c|
+      checksums = checksums_section_when_enabled do |c|
         c.checksum gem_repo4, "isolated_dep", "2.0.1"
         c.checksum gem_repo4, "isolated_owner", "1.0.2"
         c.checksum gem_repo4, "shared_dep", "5.0.1"

spec/bundler/install/gemfile/gemspec_spec.rb

@@ -368,7 +368,7 @@ RSpec.describe "bundle install from an existing gemspec" do
         gemspec :path => "../foo"
       G
 
-      checksums = checksums_section_when_existing do |c|
+      checksums = checksums_section_when_enabled do |c|
         c.no_checksum "foo", "1.0"
       end
 
@@ -463,7 +463,7 @@ RSpec.describe "bundle install from an existing gemspec" do
           it "keeps all platform dependencies in the lockfile" do
             expect(the_bundle).to include_gems "foo 1.0", "platform_specific 1.0 ruby"
 
-            checksums = checksums_section_when_existing do |c|
+            checksums = checksums_section_when_enabled do |c|
               c.no_checksum "foo", "1.0"
               c.checksum gem_repo2, "platform_specific", "1.0"
               c.checksum gem_repo2, "platform_specific", "1.0", "java"
@@ -504,7 +504,7 @@ RSpec.describe "bundle install from an existing gemspec" do
           it "keeps all platform dependencies in the lockfile" do
             expect(the_bundle).to include_gems "foo 1.0", "platform_specific 1.0 ruby"
 
-            checksums = checksums_section_when_existing do |c|
+            checksums = checksums_section_when_enabled do |c|
               c.no_checksum "foo", "1.0"
               c.checksum gem_repo2, "platform_specific", "1.0"
               c.checksum gem_repo2, "platform_specific", "1.0", "java"
@@ -546,7 +546,7 @@ RSpec.describe "bundle install from an existing gemspec" do
           it "keeps all platform dependencies in the lockfile" do
             expect(the_bundle).to include_gems "foo 1.0", "indirect_platform_specific 1.0", "platform_specific 1.0 ruby"
 
-            checksums = checksums_section_when_existing do |c|
+            checksums = checksums_section_when_enabled do |c|
               c.no_checksum "foo", "1.0"
               c.checksum gem_repo2, "indirect_platform_specific", "1.0"
               c.checksum gem_repo2, "platform_specific", "1.0"
@@ -641,7 +641,7 @@ RSpec.describe "bundle install from an existing gemspec" do
         gemspec :path => "../chef"
       G
 
-      checksums = checksums_section_when_existing do |c|
+      checksums = checksums_section_when_enabled do |c|
         c.no_checksum "chef", "17.1.17"
         c.no_checksum "chef", "17.1.17", "universal-mingw32"
         c.checksum gem_repo4, "win32-api", "1.5.3", "universal-mingw32"
@@ -705,9 +705,9 @@ RSpec.describe "bundle install from an existing gemspec" do
     end
 
     it "does not remove the platform specific specs from the lockfile when re-resolving due to gemspec changes" do
-      checksums = checksums_section_when_existing do |c|
+      checksums = checksums_section_when_enabled do |c|
         c.no_checksum "activeadmin", "2.9.0"
-        c.no_checksum "jruby-openssl", "0.10.7", "java"
+        c.checksum gem_repo4, "jruby-openssl", "0.10.7", "java"
         c.checksum gem_repo4, "railties", "6.1.4"
       end
 

spec/bundler/install/gemfile/install_if_spec.rb

@@ -18,11 +18,11 @@ RSpec.describe "bundle install with install_if conditionals" do
     expect(the_bundle).not_to include_gems("thin")
     expect(the_bundle).not_to include_gems("foo")
 
-    checksums = checksums_section_when_existing do |c|
+    checksums = checksums_section_when_enabled do |c|
       c.checksum gem_repo1, "activesupport", "2.3.5"
-      c.no_checksum "foo", "1.0"
+      c.checksum gem_repo1, "foo", "1.0"
       c.checksum gem_repo1, "myrack", "1.0.0"
-      c.no_checksum "thin", "1.0"
+      c.checksum gem_repo1, "thin", "1.0"
     end
 
     expect(lockfile).to eq <<~L

spec/bundler/install/gemfile/path_spec.rb

@@ -98,7 +98,7 @@ RSpec.describe "bundle install with explicit source paths" do
       gem "aaa", :path => "./aaa"
     G
 
-    checksums = checksums_section_when_existing do |c|
+    checksums = checksums_section_when_enabled do |c|
       c.no_checksum "aaa", "1.0"
       c.no_checksum "demo", "1.0"
     end
@@ -346,7 +346,7 @@ RSpec.describe "bundle install with explicit source paths" do
 
     lockfile_path = lib_path("foo/Gemfile.lock")
 
-    checksums = checksums_section_when_existing do |c|
+    checksums = checksums_section_when_enabled do |c|
       c.no_checksum "foo", "0.1.0"
       c.checksum gem_repo4, "graphql", "2.0.15"
     end
@@ -675,7 +675,7 @@ RSpec.describe "bundle install with explicit source paths" do
 
       expect(the_bundle).to include_gems "myrack 0.9.1"
 
-      checksums = checksums_section_when_existing do |c|
+      checksums = checksums_section_when_enabled do |c|
         c.no_checksum "foo", "1.0"
         c.checksum gem_repo1, "myrack", "0.9.1"
       end
@@ -742,7 +742,7 @@ RSpec.describe "bundle install with explicit source paths" do
 
       expect(the_bundle).to include_gems "myrack 0.9.1"
 
-      checksums = checksums_section_when_existing do |c|
+      checksums = checksums_section_when_enabled do |c|
         c.no_checksum "foo", "1.0"
         c.checksum gem_repo1, "myrack", "0.9.1"
       end
@@ -810,7 +810,7 @@ RSpec.describe "bundle install with explicit source paths" do
         s.add_dependency "myrack", "0.9.1"
       end
 
-      checksums = checksums_section_when_existing do |c|
+      checksums = checksums_section_when_enabled do |c|
         c.no_checksum "foo", "1.0"
       end
 
@@ -832,7 +832,7 @@ RSpec.describe "bundle install with explicit source paths" do
 
       bundle "lock"
 
-      checksums.no_checksum "myrack", "0.9.1"
+      checksums.checksum gem_repo1, "myrack", "0.9.1"
 
       expect(lockfile).to eq <<~G
         PATH

spec/bundler/install/gemfile/platform_spec.rb

@@ -202,7 +202,7 @@ RSpec.describe "bundle install across platforms" do
         gem "pry"
       G
 
-      checksums = checksums_section_when_existing do |c|
+      checksums = checksums_section_when_enabled do |c|
         c.checksum gem_repo4, "coderay", "1.1.2"
         c.checksum gem_repo4, "empyrean", "0.1.0"
         c.checksum gem_repo4, "ffi", "1.9.23", "java"
@@ -239,6 +239,8 @@ RSpec.describe "bundle install across platforms" do
 
       bundle "lock --add-platform ruby"
 
+      checksums.checksum gem_repo4, "pry", "0.11.3"
+
       good_lockfile = <<~L
         GEM
           remote: https://gem.repo4/
@@ -372,7 +374,7 @@ RSpec.describe "bundle install across platforms" do
   end
 
   it "keeps existing platforms when installing with force_ruby_platform" do
-    checksums = checksums_section_when_existing do |c|
+    checksums = checksums_section_when_enabled do |c|
       c.checksum gem_repo1, "platform_specific", "1.0"
       c.checksum gem_repo1, "platform_specific", "1.0", "java"
     end
@@ -584,7 +586,7 @@ RSpec.describe "bundle install with platform conditionals" do
 
       DEPENDENCIES
         myrack
-      #{checksums_section_when_existing}
+      #{checksums_section_when_enabled}
       BUNDLED WITH
          #{Bundler::VERSION}
     L

spec/bundler/install/gemfile/sources_spec.rb

@@ -377,7 +377,7 @@ RSpec.describe "bundle install with gems on multiple sources" do
           expect(err).to include("Warning: the gem 'myrack' was found in multiple sources.")
           expect(err).to include("Installed from: https://gem.repo2")
 
-          checksums = checksums_section_when_existing do |c|
+          checksums = checksums_section_when_enabled do |c|
             c.checksum gem_repo3, "depends_on_myrack", "1.0.1"
             c.checksum gem_repo2, "myrack", "1.0.0"
           end
@@ -417,7 +417,7 @@ RSpec.describe "bundle install with gems on multiple sources" do
           expect(err).to include("Warning: the gem 'myrack' was found in multiple sources.")
           expect(err).to include("Installed from: https://gem.repo2")
 
-          checksums = checksums_section_when_existing do |c|
+          checksums = checksums_section_when_enabled do |c|
             c.no_checksum "depends_on_myrack", "1.0.1"
             c.no_checksum "myrack", "1.0.0"
           end
@@ -783,7 +783,7 @@ RSpec.describe "bundle install with gems on multiple sources" do
           end
         G
 
-        @locked_checksums = checksums_section_when_existing do |c|
+        @locked_checksums = checksums_section_when_enabled do |c|
           c.checksum gem_repo2, "activesupport", "6.0.3.4"
           c.checksum gem_repo2, "concurrent-ruby", "1.1.8"
           c.checksum gem_repo2, "connection_pool", "2.2.3"
@@ -1106,7 +1106,7 @@ RSpec.describe "bundle install with gems on multiple sources" do
       end
 
       it "installs from the default source without any warnings or errors and generates a proper lockfile" do
-        checksums = checksums_section_when_existing do |c|
+        checksums = checksums_section_when_enabled do |c|
           c.checksum gem_repo3, "handsoap", "0.2.5.5"
           c.checksum gem_repo2, "nokogiri", "1.11.1"
           c.checksum gem_repo2, "racca", "1.5.2"
@@ -1692,7 +1692,7 @@ RSpec.describe "bundle install with gems on multiple sources" do
     it "upgrades the lockfile correctly" do
       bundle "lock --update", artifice: "compact_index"
 
-      checksums = checksums_section_when_existing do |c|
+      checksums = checksums_section_when_enabled do |c|
         c.checksum gem_repo2, "capybara", "2.5.0"
         c.checksum gem_repo4, "mime-types", "3.0.0"
       end
@@ -1751,7 +1751,7 @@ RSpec.describe "bundle install with gems on multiple sources" do
     it "handles that fine" do
       bundle "install", artifice: "compact_index_extra"
 
-      checksums = checksums_section_when_existing do |c|
+      checksums = checksums_section_when_enabled do |c|
         c.checksum gem_repo4, "pdf-writer", "1.1.8"
         c.checksum gem_repo2, "ruport", "1.7.0.3"
       end
@@ -1809,7 +1809,7 @@ RSpec.describe "bundle install with gems on multiple sources" do
     it "handles that fine" do
       bundle "install", artifice: "compact_index_extra"
 
-      checksums = checksums_section_when_existing do |c|
+      checksums = checksums_section_when_enabled do |c|
         c.checksum gem_repo4, "pdf-writer", "1.1.8"
         c.checksum gem_repo2, "ruport", "1.7.0.3"
       end
@@ -1861,7 +1861,7 @@ RSpec.describe "bundle install with gems on multiple sources" do
     it "handles that fine" do
       bundle "install --verbose", artifice: "endpoint"
 
-      checksums = checksums_section_when_existing do |c|
+      checksums = checksums_section_when_enabled do |c|
         c.checksum gem_repo4, "pdf-writer", "1.1.8"
       end
 

spec/bundler/install/gemfile/specific_platform_spec.rb

@@ -66,7 +66,7 @@ RSpec.describe "bundle install with specific platforms" do
 
       gemfile google_protobuf
 
-      checksums = checksums_section_when_existing do |c|
+      checksums = checksums_section_when_enabled do |c|
         c.checksum gem_repo2, "google-protobuf", "3.0.0.alpha.4.0"
       end
 
@@ -528,7 +528,7 @@ RSpec.describe "bundle install with specific platforms" do
 
     bundle "update"
 
-    checksums = checksums_section_when_existing do |c|
+    checksums = checksums_section_when_enabled do |c|
       c.checksum gem_repo4, "sorbet", "0.5.10160"
       c.checksum gem_repo4, "sorbet-runtime", "0.5.10160"
       c.checksum gem_repo4, "sorbet-static", "0.5.10160", Gem::Platform.local
@@ -584,9 +584,9 @@ RSpec.describe "bundle install with specific platforms" do
       G
     end
 
-    checksums = checksums_section_when_existing do |c|
-      c.no_checksum "nokogiri", "1.13.0", "x86_64-darwin"
-      c.no_checksum "sorbet-static", "0.5.10601", "x86_64-darwin"
+    checksums = checksums_section_when_enabled do |c|
+      c.checksum gem_repo4, "nokogiri", "1.13.0", "x86_64-darwin"
+      c.checksum gem_repo4, "sorbet-static", "0.5.10601", "x86_64-darwin"
     end
 
     lockfile <<~L
@@ -680,7 +680,7 @@ RSpec.describe "bundle install with specific platforms" do
 
     bundle "update"
 
-    checksums = checksums_section_when_existing do |c|
+    checksums = checksums_section_when_enabled do |c|
       c.checksum gem_repo4, "sorbet", "0.5.10160"
       c.checksum gem_repo4, "sorbet-runtime", "0.5.10160"
       c.checksum gem_repo4, "sorbet-static", "0.5.10160", Gem::Platform.local
@@ -755,7 +755,7 @@ RSpec.describe "bundle install with specific platforms" do
 
       bundle "update"
 
-      checksums = checksums_section_when_existing do |c|
+      checksums = checksums_section_when_enabled do |c|
         c.checksum gem_repo4, "nokogiri", "1.14.0", "x86_64-linux"
         c.checksum gem_repo4, "sorbet-static", "0.5.10696", "x86_64-linux"
       end
@@ -799,7 +799,7 @@ RSpec.describe "bundle install with specific platforms" do
         gem "sorbet-static", "= 0.5.10549"
       G
 
-      checksums = checksums_section_when_existing do |c|
+      checksums = checksums_section_when_enabled do |c|
         c.checksum gem_repo4, "sorbet-static", "0.5.10549", "universal-darwin-20"
         c.checksum gem_repo4, "sorbet-static", "0.5.10549", "universal-darwin-21"
       end
@@ -823,8 +823,6 @@ RSpec.describe "bundle install with specific platforms" do
 
       bundle "install"
 
-      checksums.no_checksum "sorbet-static", "0.5.10549", "universal-darwin-21"
-
       expect(lockfile).to eq <<~L
         GEM
           remote: https://gem.repo4/
@@ -917,7 +915,7 @@ RSpec.describe "bundle install with specific platforms" do
       gem "tzinfo", "~> 1.2", platform: :#{not_local_tag}
     G
 
-    checksums = checksums_section_when_existing do |c|
+    checksums = checksums_section_when_enabled do |c|
       c.checksum gem_repo4, "nokogiri", "1.13.8"
       c.checksum gem_repo4, "nokogiri", "1.13.8", Gem::Platform.local
     end
@@ -963,9 +961,8 @@ RSpec.describe "bundle install with specific platforms" do
       gem "tzinfo", "~> 1.2", platforms: %i[mingw mswin x64_mingw jruby]
     G
 
-    checksums = checksums_section_when_existing do |c|
+    checksums = checksums_section_when_enabled do |c|
       c.checksum gem_repo4, "nokogiri", "1.13.8"
-      c.checksum gem_repo4, "nokogiri", "1.13.8", "arm64-darwin"
     end
 
     original_lockfile = <<~L
@@ -1007,9 +1004,9 @@ RSpec.describe "bundle install with specific platforms" do
       gem "myrack"
     G
 
-    checksums = checksums_section_when_existing do |c|
-      c.no_checksum "concurrent-ruby", "1.2.2"
-      c.no_checksum "myrack", "3.0.7"
+    checksums = checksums_section_when_enabled do |c|
+      c.checksum gem_repo4, "concurrent-ruby", "1.2.2"
+      c.checksum gem_repo4, "myrack", "3.0.7"
     end
 
     lockfile <<~L
@@ -1104,7 +1101,7 @@ RSpec.describe "bundle install with specific platforms" do
         gem "nokogiri", "1.14.0"
       G
 
-      checksums = checksums_section_when_existing do |c|
+      checksums = checksums_section_when_enabled do |c|
         c.checksum gem_repo4, "nokogiri", "1.14.0", "x86_64-linux"
       end
 
@@ -1126,7 +1123,7 @@ RSpec.describe "bundle install with specific platforms" do
 
       bundle :install
 
-      checksums = checksums_section_when_existing do |c|
+      checksums = checksums_section_when_enabled do |c|
         c.checksum gem_repo4, "nokogiri", "1.14.0"
       end
 
@@ -1235,10 +1232,10 @@ RSpec.describe "bundle install with specific platforms" do
 
       bundle "lock"
 
-      checksums = checksums_section_when_existing do |c|
-        c.no_checksum "nokogiri", "1.14.0"
-        c.no_checksum "nokogiri", "1.14.0", "arm-linux"
-        c.no_checksum "nokogiri", "1.14.0", "x86_64-linux"
+      checksums = checksums_section_when_enabled do |c|
+        c.checksum gem_repo4, "nokogiri", "1.14.0"
+        c.checksum gem_repo4, "nokogiri", "1.14.0", "arm-linux"
+        c.checksum gem_repo4, "nokogiri", "1.14.0", "x86_64-linux"
       end
 
       # locks all compatible platforms, excluding Java and Windows
@@ -1274,8 +1271,8 @@ RSpec.describe "bundle install with specific platforms" do
       bundle "lock"
 
       checksums.delete "nokogiri", "arm-linux"
-      checksums.no_checksum "sorbet-static", "0.5.10696", "universal-darwin-22"
-      checksums.no_checksum "sorbet-static", "0.5.10696", "x86_64-linux"
+      checksums.checksum gem_repo4, "sorbet-static", "0.5.10696", "universal-darwin-22"
+      checksums.checksum gem_repo4, "sorbet-static", "0.5.10696", "x86_64-linux"
 
       # locks only platforms compatible with all gems in the bundle
       expect(lockfile).to eq(<<~L)
@@ -1324,9 +1321,9 @@ RSpec.describe "bundle install with specific platforms" do
       gem "sass-embedded"
     G
 
-    checksums = checksums_section_when_existing do |c|
+    checksums = checksums_section_when_enabled do |c|
       c.checksum gem_repo4, "nokogiri", "1.15.5"
-      c.no_checksum "sass-embedded", "1.69.5"
+      c.checksum gem_repo4, "sass-embedded", "1.69.5"
       c.checksum gem_repo4, "sass-embedded", "1.69.5", "x86_64-linux-gnu"
     end
 
@@ -1373,7 +1370,7 @@ RSpec.describe "bundle install with specific platforms" do
       gem "nokogiri"
     G
 
-    checksums = checksums_section_when_existing do |c|
+    checksums = checksums_section_when_enabled do |c|
       c.checksum gem_repo4, "nokogiri", "1.15.5", "x86_64-linux"
     end
 
@@ -1420,6 +1417,11 @@ RSpec.describe "bundle install with specific platforms" do
         simulate_platform host_platform do
           bundle "lock"
 
+          checksums = checksums_section_when_enabled do |c|
+            c.checksum gem_repo4, "rcee_precompiled", "0.5.0", "x86_64-linux"
+            c.checksum gem_repo4, "rcee_precompiled", "0.5.0", "x86_64-linux-musl"
+          end
+
           expect(lockfile).to eq(<<~L)
             GEM
               remote: https://gem.repo4/
@@ -1433,7 +1435,7 @@ RSpec.describe "bundle install with specific platforms" do
 
             DEPENDENCIES
               rcee_precompiled (= 0.5.0)
-
+            #{checksums}
             BUNDLED WITH
                #{Bundler::VERSION}
           L
@@ -1462,6 +1464,11 @@ RSpec.describe "bundle install with specific platforms" do
     simulate_platform "x86_64-linux-musl" do
       bundle "lock"
 
+      checksums = checksums_section_when_enabled do |c|
+        c.checksum gem_repo4, "rcee_precompiled", "0.5.0", "x86_64-linux-gnu"
+        c.checksum gem_repo4, "rcee_precompiled", "0.5.0", "x86_64-linux-musl"
+      end
+
       expect(lockfile).to eq(<<~L)
         GEM
           remote: https://gem.repo4/
@@ -1475,7 +1482,7 @@ RSpec.describe "bundle install with specific platforms" do
 
         DEPENDENCIES
           rcee_precompiled (= 0.5.0)
-
+        #{checksums}
         BUNDLED WITH
            #{Bundler::VERSION}
       L
@@ -1498,6 +1505,10 @@ RSpec.describe "bundle install with specific platforms" do
     simulate_platform "x86_64-darwin-15" do
       bundle "lock"
 
+      checksums = checksums_section_when_enabled do |c|
+        c.checksum gem_repo4, "rcee_precompiled", "0.5.0", "universal-darwin"
+      end
+
       expect(lockfile).to eq(<<~L)
         GEM
           remote: https://gem.repo4/
@@ -1509,7 +1520,7 @@ RSpec.describe "bundle install with specific platforms" do
 
         DEPENDENCIES
           rcee_precompiled (= 0.5.0)
-
+        #{checksums}
         BUNDLED WITH
            #{Bundler::VERSION}
       L

spec/bundler/install/gems/flex_spec.rb

@@ -268,7 +268,7 @@ RSpec.describe "bundle flex_install" do
     it "should work when you install" do
       bundle "install"
 
-      checksums = checksums_section_when_existing do |c|
+      checksums = checksums_section_when_enabled do |c|
         c.checksum gem_repo1, "myrack", "0.9.1"
         c.checksum gem_repo1, "myrack-obama", "1.0"
       end
@@ -313,7 +313,7 @@ RSpec.describe "bundle flex_install" do
         gem "myrack"
       G
 
-      checksums = checksums_section_when_existing do |c|
+      checksums = checksums_section_when_enabled do |c|
         c.checksum gem_repo1, "myrack", "1.0.0"
       end
 

spec/bundler/install/gems/resolving_spec.rb

@@ -282,7 +282,7 @@ RSpec.describe "bundle install with install-time dependencies" do
         it "automatically updates lockfile to use the older version" do
           bundle "install --verbose"
 
-          checksums = checksums_section_when_existing do |c|
+          checksums = checksums_section_when_enabled do |c|
             c.checksum gem_repo2, "parallel_tests", "3.7.0"
           end
 
@@ -369,7 +369,7 @@ RSpec.describe "bundle install with install-time dependencies" do
         it "automatically updates lockfile to use the older compatible versions" do
           bundle "install --verbose"
 
-          checksums = checksums_section_when_existing do |c|
+          checksums = checksums_section_when_enabled do |c|
             c.checksum gem_repo2, "rubocop", "1.28.2"
             c.checksum gem_repo2, "rubocop-ast", "1.17.0"
           end

spec/bundler/lock/lockfile_spec.rb

@@ -6,7 +6,7 @@ RSpec.describe "the lockfile format" do
   end
 
   it "generates a simple lockfile for a single source, gem" do
-    checksums = checksums_section_when_existing do |c|
+    checksums = checksums_section_when_enabled do |c|
       c.checksum(gem_repo2, "myrack", "1.0.0")
     end
 
@@ -281,7 +281,7 @@ RSpec.describe "the lockfile format" do
       gem "myrack-obama"
     G
 
-    checksums = checksums_section_when_existing do |c|
+    checksums = checksums_section_when_enabled do |c|
       c.checksum gem_repo2, "myrack", "1.0.0"
       c.checksum gem_repo2, "myrack-obama", "1.0"
     end
@@ -312,7 +312,7 @@ RSpec.describe "the lockfile format" do
       gem "myrack-obama", ">= 1.0"
     G
 
-    checksums = checksums_section_when_existing do |c|
+    checksums = checksums_section_when_enabled do |c|
       c.checksum gem_repo2, "myrack", "1.0.0"
       c.checksum gem_repo2, "myrack-obama", "1.0"
     end
@@ -351,7 +351,7 @@ RSpec.describe "the lockfile format" do
       end
     G
 
-    checksums = checksums_section_when_existing do |c|
+    checksums = checksums_section_when_enabled do |c|
       c.checksum gem_repo2, "myrack", "1.0.0"
       c.checksum gem_repo2, "myrack-obama", "1.0"
     end
@@ -398,7 +398,7 @@ RSpec.describe "the lockfile format" do
       end
     G
 
-    checksums = checksums_section_when_existing do |c|
+    checksums = checksums_section_when_enabled do |c|
       c.checksum gem_repo2, "myrack", "1.0.0"
       c.checksum gem_repo2, "myrack-obama", "1.0"
     end
@@ -459,7 +459,7 @@ RSpec.describe "the lockfile format" do
       end
     G
 
-    checksums = checksums_section_when_existing do |c|
+    checksums = checksums_section_when_enabled do |c|
       c.checksum gem_repo2, "myrack", "1.0.0"
       c.checksum gem_repo2, "myrack-obama", "1.0"
     end
@@ -503,7 +503,7 @@ RSpec.describe "the lockfile format" do
       gem "net-sftp"
     G
 
-    checksums = checksums_section_when_existing do |c|
+    checksums = checksums_section_when_enabled do |c|
       c.checksum gem_repo2, "net-sftp", "1.1.1"
       c.checksum gem_repo2, "net-ssh", "1.0"
     end
@@ -537,7 +537,7 @@ RSpec.describe "the lockfile format" do
       gem "foo", :git => "#{lib_path("foo-1.0")}"
     G
 
-    checksums = checksums_section_when_existing do |c|
+    checksums = checksums_section_when_enabled do |c|
       c.no_checksum "foo", "1.0"
     end
 
@@ -605,7 +605,7 @@ RSpec.describe "the lockfile format" do
   it "serializes global git sources" do
     git = build_git "foo"
 
-    checksums = checksums_section_when_existing do |c|
+    checksums = checksums_section_when_enabled do |c|
       c.no_checksum "foo", "1.0"
     end
 
@@ -642,7 +642,7 @@ RSpec.describe "the lockfile format" do
     git = build_git "foo"
     update_git "foo", branch: "omg"
 
-    checksums = checksums_section_when_existing do |c|
+    checksums = checksums_section_when_enabled do |c|
       c.no_checksum "foo", "1.0"
     end
 
@@ -678,7 +678,7 @@ RSpec.describe "the lockfile format" do
     git = build_git "foo"
     update_git "foo", tag: "omg"
 
-    checksums = checksums_section_when_existing do |c|
+    checksums = checksums_section_when_enabled do |c|
       c.no_checksum "foo", "1.0"
     end
 
@@ -799,7 +799,7 @@ RSpec.describe "the lockfile format" do
   it "serializes pinned path sources to the lockfile" do
     build_lib "foo"
 
-    checksums = checksums_section_when_existing do |c|
+    checksums = checksums_section_when_enabled do |c|
       c.no_checksum "foo", "1.0"
     end
 
@@ -832,15 +832,15 @@ RSpec.describe "the lockfile format" do
   it "serializes pinned path sources to the lockfile even when packaging" do
     build_lib "foo"
 
-    checksums = checksums_section_when_existing do |c|
-      c.no_checksum "foo", "1.0"
-    end
-
     install_gemfile <<-G
       source "https://gem.repo1"
       gem "foo", :path => "#{lib_path("foo-1.0")}"
     G
 
+    checksums = checksums_section_when_enabled do |c|
+      c.no_checksum "foo", "1.0"
+    end
+
     bundle "config set cache_all true"
     bundle :cache
     bundle :install, local: true
@@ -870,7 +870,7 @@ RSpec.describe "the lockfile format" do
     build_lib "foo"
     bar = build_git "bar"
 
-    checksums = checksums_section_when_existing do |c|
+    checksums = checksums_section_when_enabled do |c|
       c.no_checksum "foo", "1.0"
       c.no_checksum "bar", "1.0"
       c.checksum gem_repo2, "myrack", "1.0.0"
@@ -921,7 +921,7 @@ RSpec.describe "the lockfile format" do
       gem "myrack", :source => "https://gem.repo2/"
     G
 
-    checksums = checksums_section_when_existing do |c|
+    checksums = checksums_section_when_enabled do |c|
       c.checksum gem_repo2, "myrack", "1.0.0"
     end
 
@@ -951,7 +951,7 @@ RSpec.describe "the lockfile format" do
       gem "myrack-obama"
     G
 
-    checksums = checksums_section_when_existing do |c|
+    checksums = checksums_section_when_enabled do |c|
       c.checksum gem_repo2, "actionpack", "2.3.2"
       c.checksum gem_repo2, "activesupport", "2.3.2"
       c.checksum gem_repo2, "myrack", "1.0.0"
@@ -992,7 +992,7 @@ RSpec.describe "the lockfile format" do
       gem "rails"
     G
 
-    checksums = checksums_section_when_existing do |c|
+    checksums = checksums_section_when_enabled do |c|
       c.checksum gem_repo2, "actionmailer", "2.3.2"
       c.checksum gem_repo2, "actionpack", "2.3.2"
       c.checksum gem_repo2, "activerecord", "2.3.2"
@@ -1050,7 +1050,7 @@ RSpec.describe "the lockfile format" do
       gem 'double_deps'
     G
 
-    checksums = checksums_section_when_existing do |c|
+    checksums = checksums_section_when_enabled do |c|
       c.checksum gem_repo2, "double_deps", "1.0"
       c.checksum gem_repo2, "net-ssh", "1.0"
     end
@@ -1082,7 +1082,7 @@ RSpec.describe "the lockfile format" do
       gem "myrack-obama", ">= 1.0", :require => "myrack/obama"
     G
 
-    checksums = checksums_section_when_existing do |c|
+    checksums = checksums_section_when_enabled do |c|
       c.checksum gem_repo2, "myrack", "1.0.0"
       c.checksum gem_repo2, "myrack-obama", "1.0"
     end
@@ -1113,7 +1113,7 @@ RSpec.describe "the lockfile format" do
       gem "myrack-obama", ">= 1.0", :group => :test
     G
 
-    checksums = checksums_section_when_existing do |c|
+    checksums = checksums_section_when_enabled do |c|
       c.checksum gem_repo2, "myrack", "1.0.0"
       c.checksum gem_repo2, "myrack-obama", "1.0"
     end
@@ -1140,7 +1140,7 @@ RSpec.describe "the lockfile format" do
   it "stores relative paths when the path is provided in a relative fashion and in Gemfile dir" do
     build_lib "foo", path: bundled_app("foo")
 
-    checksums = checksums_section_when_existing do |c|
+    checksums = checksums_section_when_enabled do |c|
       c.no_checksum "foo", "1.0"
     end
 
@@ -1175,7 +1175,7 @@ RSpec.describe "the lockfile format" do
   it "stores relative paths when the path is provided in a relative fashion and is above Gemfile dir" do
     build_lib "foo", path: bundled_app(File.join("..", "foo"))
 
-    checksums = checksums_section_when_existing do |c|
+    checksums = checksums_section_when_enabled do |c|
       c.no_checksum "foo", "1.0"
     end
 
@@ -1210,10 +1210,6 @@ RSpec.describe "the lockfile format" do
   it "stores relative paths when the path is provided in an absolute fashion but is relative" do
     build_lib "foo", path: bundled_app("foo")
 
-    checksums = checksums_section_when_existing do |c|
-      c.no_checksum "foo", "1.0"
-    end
-
     install_gemfile <<-G
       source "https://gem.repo1"
       path File.expand_path("foo", __dir__) do
@@ -1221,6 +1217,10 @@ RSpec.describe "the lockfile format" do
       end
     G
 
+    checksums = checksums_section_when_enabled do |c|
+      c.no_checksum "foo", "1.0"
+    end
+
     expect(lockfile).to eq <<~G
       PATH
         remote: foo
@@ -1245,7 +1245,7 @@ RSpec.describe "the lockfile format" do
   it "stores relative paths when the path is provided for gemspec" do
     build_lib("foo", path: tmp("foo"))
 
-    checksums = checksums_section_when_existing do |c|
+    checksums = checksums_section_when_enabled do |c|
       c.no_checksum "foo", "1.0"
     end
 
@@ -1276,7 +1276,7 @@ RSpec.describe "the lockfile format" do
   end
 
   it "keeps existing platforms in the lockfile" do
-    checksums = checksums_section_when_existing do |c|
+    checksums = checksums_section_when_enabled do |c|
       c.no_checksum "myrack", "1.0.0"
     end
 
@@ -1340,6 +1340,11 @@ RSpec.describe "the lockfile format" do
       G
       bundle "lock --add-platform x64-mingw-ucrt"
 
+      checksums = checksums_section_when_enabled do |c|
+        c.checksum gem_repo4, "google-protobuf", "3.25.1"
+        c.checksum gem_repo4, "google-protobuf", "3.25.1", "arm64-darwin-23"
+      end
+
       expect(lockfile).to eq <<~L
         GEM
           remote: https://gem.repo4/
@@ -1354,7 +1359,7 @@ RSpec.describe "the lockfile format" do
 
         DEPENDENCIES
           google-protobuf
-
+        #{checksums}
         BUNDLED WITH
            #{Bundler::VERSION}
       L
@@ -1374,7 +1379,7 @@ RSpec.describe "the lockfile format" do
         gem "platform_specific"
       G
 
-      checksums = checksums_section_when_existing do |c|
+      checksums = checksums_section_when_enabled do |c|
         c.checksum gem_repo2, "platform_specific", "1.0", "universal-java-16"
       end
 
@@ -1397,7 +1402,7 @@ RSpec.describe "the lockfile format" do
   end
 
   it "does not add duplicate gems" do
-    checksums = checksums_section_when_existing do |c|
+    checksums = checksums_section_when_enabled do |c|
       c.checksum(gem_repo2, "activesupport", "2.3.5")
       c.checksum(gem_repo2, "myrack", "1.0.0")
     end
@@ -1433,7 +1438,7 @@ RSpec.describe "the lockfile format" do
   end
 
   it "does not add duplicate dependencies" do
-    checksums = checksums_section_when_existing do |c|
+    checksums = checksums_section_when_enabled do |c|
       c.checksum(gem_repo2, "myrack", "1.0.0")
     end
 
@@ -1461,7 +1466,7 @@ RSpec.describe "the lockfile format" do
   end
 
   it "does not add duplicate dependencies with versions" do
-    checksums = checksums_section_when_existing do |c|
+    checksums = checksums_section_when_enabled do |c|
       c.checksum(gem_repo2, "myrack", "1.0.0")
     end
 
@@ -1489,7 +1494,7 @@ RSpec.describe "the lockfile format" do
   end
 
   it "does not add duplicate dependencies in different groups" do
-    checksums = checksums_section_when_existing do |c|
+    checksums = checksums_section_when_enabled do |c|
       c.checksum(gem_repo2, "myrack", "1.0.0")
     end
 
@@ -1539,7 +1544,7 @@ RSpec.describe "the lockfile format" do
   end
 
   it "works correctly with multiple version dependencies" do
-    checksums = checksums_section_when_existing do |c|
+    checksums = checksums_section_when_enabled do |c|
       c.checksum(gem_repo2, "myrack", "0.9.1")
     end
 
@@ -1566,7 +1571,7 @@ RSpec.describe "the lockfile format" do
   end
 
   it "captures the Ruby version in the lockfile" do
-    checksums = checksums_section_when_existing do |c|
+    checksums = checksums_section_when_enabled do |c|
       c.checksum(gem_repo2, "myrack", "0.9.1")
     end
 

spec/bundler/plugins/source/example_spec.rb

@@ -70,7 +70,7 @@ RSpec.describe "real source plugins" do
     it "writes to lock file" do
       bundle "install"
 
-      checksums = checksums_section_when_existing do |c|
+      checksums = checksums_section_when_enabled do |c|
         c.no_checksum "a-path-gem", "1.0"
       end
 
@@ -340,7 +340,7 @@ RSpec.describe "real source plugins" do
       revision = revision_for(lib_path("ma-gitp-gem-1.0"))
       bundle "install"
 
-      checksums = checksums_section_when_existing do |c|
+      checksums = checksums_section_when_enabled do |c|
         c.no_checksum "ma-gitp-gem", "1.0"
       end
 

spec/bundler/support/checksums.rb

@@ -54,11 +54,11 @@ module Spec
       ChecksumsBuilder.new(enabled, &block)
     end
 
-    def checksums_section_when_existing(&block)
+    def checksums_section_when_enabled(target_lockfile = nil, &block)
       begin
-        enabled = lockfile.match?(/^CHECKSUMS$/)
+        enabled = (target_lockfile || lockfile).match?(/^CHECKSUMS$/)
       rescue Errno::ENOENT
-        enabled = false
+        enabled = Bundler.feature_flag.bundler_3_mode?
       end
       checksums_section(enabled, &block)
     end

spec/bundler/update/git_spec.rb

@@ -309,7 +309,7 @@ RSpec.describe "bundle update" do
 
       bundle "update --source bar"
 
-      checksums = checksums_section_when_existing do |c|
+      checksums = checksums_section_when_enabled do |c|
         c.no_checksum "foo", "2.0"
         c.checksum gem_repo2, "myrack", "1.0.0"
       end