Add bundler checksums

ruby/private/bundle_fetch.bzl

@@ -7,6 +7,7 @@ load(
     _normalize_bzlmod_repository_name = "normalize_bzlmod_repository_name",
 )
 load("//ruby/private/bundle_fetch:gemfile_lock_parser.bzl", "parse_gemfile_lock")
+load("//ruby/private:bundler_checksums.bzl", "BUNDLER_CHECKUMS")
 
 # Location of Bundler binstubs to generate shims and use during rb_bundle_install(...).
 BINSTUBS_LOCATION = "bin/private"
@@ -105,6 +106,7 @@ def _rb_bundle_fetch_impl(repository_ctx):
     gemfile_lock = parse_gemfile_lock(
         repository_ctx.read(gemfile_lock_path),
         repository_ctx.attr.bundler_remote,
+        repository_ctx.attr.bundler_checksums,
     )
     if not versions.is_at_least("2.2.19", gemfile_lock.bundler.version):
         fail(_OUTDATED_BUNDLER_ERROR)
@@ -205,6 +207,10 @@ rb_bundle_fetch = repository_rule(
             default = "https://rubygems.org/",
             doc = "Remote to fetch the bundler gem from.",
         ),
+        "bundler_checksums": attr.string_dict(
+            default = BUNDLER_CHECKUMS,
+            doc = "Map from Bundler version to its SHA-256 checksum.",
+        ),
         "_build_tpl": attr.label(
             allow_single_file = True,
             default = "@rules_ruby//:ruby/private/bundle_fetch/BUILD.tpl",

ruby/private/bundle_fetch/gemfile_lock_parser.bzl

@@ -111,7 +111,7 @@ def _parse_git_package(lines):
 
     return {"revision": revision, "remote": remote}
 
-def parse_gemfile_lock(content, bundler_remote):
+def parse_gemfile_lock(content, bundler_remote, bundler_checksums):
     """Parses a Gemfile.lock.
 
     Find lines in the content of a Gemfile.lock that look like package
@@ -120,6 +120,7 @@ def parse_gemfile_lock(content, bundler_remote):
     Args:
         content: Gemfile.lock contents
         bundler_remote: Remote URL for the bundler package.
+        bundler_checksums: Map from bundler version to sha256 checksum.
 
     Returns:
         struct with parsed Gemfile.lock
@@ -182,6 +183,7 @@ def parse_gemfile_lock(content, bundler_remote):
                 filename = "bundler-%s.gem" % version,
                 full_name = "bundler-%s" % version,
                 remote = bundler_remote,
+                sha256 = bundler_checksums.get(version, None),
             )
             inside_bundled_with = False