[8.18] Fixes to the bundles gems and jars versions (backport #17659) (#17662)

* Fixes to the bundles gems and jars versions (#17659)

* Avoid hard pins on gem versions in the Gemfile.template and remove some duplicated gems which are already vendored to an upper version

* exclude inactive net-imap-0.2.3 from artifacts

* artifacts: exclude "default" stdlib gems that are shadowed by pinned gems

---------

Co-authored-by: Ry Biesemeyer <ry.biesemeyer@elastic.co>
(cherry picked from commit 06c877e)

# Conflicts:
#	Gemfile.template

* fix conflict (line order)

---------

Co-authored-by: Andrea Selva <selva.andre@gmail.com>
Co-authored-by: Rye Biesemeyer <yaauie@users.noreply.github.com>

Author: 3 people

Gemfile.template

@@ -46,5 +46,5 @@ gem "thwait"
 gem "bigdecimal", "~> 3.1"
 
 gem "psych", "5.2.2"
-gem "uri", "0.12.3" # Pins until a new jruby version with updated uri is released
-gem "cgi", "0.3.7" # Pins until a new jruby version with updated cgi is released
+gem "cgi", "~> 0.3.7" # Pins until a new jruby version with updated cgi is released
+gem "uri", "~> 0.12.3" # Pins until a new jruby version with updated cgi is released

logstash-core/lib/logstash/agent.rb

@@ -15,6 +15,17 @@
 # specific language governing permissions and limitations
 # under the License.
 
+# BEGIN: eager-load interesting stdlib/default dependencies
+# We exclude from built artifacts the stdlib implementations of "default gems"
+# for which our bundle pins to a later version. Requiring them here ensures
+# that our build breaks if doing so excludes the ONLY implementation, which
+# would be possible if an updated JRuby includes a "default gem" that meets
+# the pin criteria.
+# SEE: https://github.com/elastic/logstash/pull/17659
+require 'cgi'
+require 'uri'
+# END: eager load
+
 require "logstash/environment"
 require "logstash/config/cpu_core_strategy"
 require "logstash/instrument/collector"

rakelib/artifacts.rake

@@ -105,6 +105,23 @@ namespace "artifact" do
     @exclude_paths << 'vendor/jruby/lib/ruby/gems/shared/gems/rexml-3.2.5/**/*'
     @exclude_paths << 'vendor/jruby/lib/ruby/gems/shared/specifications/rexml-3.2.5.gemspec'
 
+    # remove this after JRuby includes cgi-0.3.7+
+    @exclude_paths << 'vendor/jruby/lib/ruby/gems/shared/specifications/default/cgi-0.3.6-java.gemspec'
+    @exclude_paths << 'vendor/jruby/lib/ruby/stdlib/cgi{,.rb}'
+    @exclude_paths << 'vendor/jruby/lib/ruby/stdlib/cgi/**/*'
+
+    # remove this after JRuby includes net-imap-0.2.4+
+    @exclude_paths << 'vendor/jruby/lib/ruby/gems/shared/specifications/net-imap-0.2.3.gemspec'
+    @exclude_paths << 'vendor/jruby/lib/ruby/gems/shared/gems/net-imap-0.2.3/**/*'
+
+    # remove this after JRuby includes uri-0.12.3+
+    @exclude_paths << 'vendor/jruby/lib/ruby/gems/shared/specifications/default/uri-0.12.2.gemspec'
+    @exclude_paths << 'vendor/jruby/lib/ruby/stdlib/uri{,.rb}'
+    @exclude_paths << 'vendor/jruby/lib/ruby/stdlib/uri/**/*'
+
+    # remove jruby-openssl shipped with JRuby to prefer the one from the lockfile
+    @exclude_paths << 'vendor/jruby/lib/ruby/stdlib/jopenssl.jar'
+
     @exclude_paths
   end