Restore lockfile remote order for GEM sections

Bundler::Source::Rubygems stores remotes in reverse of the lockfile
order, so reading them straight through flipped which remote a spec
downloads from when a GEM section lists more than one.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: hsbt

lib/rubygems/request_set.rb

@@ -354,7 +354,10 @@ def load_lockfile(lock_file) # :nodoc:
     parser.specs.group_by(&:source).each do |source, specs|
       case source
       when Bundler::Source::Rubygems
-        remotes = source.remotes.map {|remote| Gem::Source.new(remote.to_s) }
+        # Bundler::Source::Rubygems stores remotes in reverse of the lockfile
+        # order (Bundler::Source::Rubygems#to_lock reverses them back), so
+        # restore the lockfile order here.
+        remotes = source.remotes.reverse.map {|remote| Gem::Source.new(remote.to_s) }
         remotes << Gem::Source.new(Gem::DEFAULT_HOST) if remotes.empty?
         lock_set = Gem::Resolver::LockSet.new(remotes)
         specs.each do |spec|

test/rubygems/test_gem_request_set.rb

@@ -385,6 +385,39 @@ def test_load_gemdeps_with_lockfile_gem_section
     assert_equal [dep("a", "~> 1.0")], spec.dependencies
   end
 
+  def test_load_gemdeps_with_lockfile_gem_section_multiple_remotes
+    rs = Gem::RequestSet.new
+
+    File.open "gem.deps.rb", "w" do |io|
+      io.puts 'gem "a"'
+    end
+
+    File.open "gem.deps.rb.lock", "w" do |io|
+      io.puts <<~LOCKFILE
+        GEM
+          remote: https://gems.example/
+          remote: https://other.example/
+          specs:
+            a (2)
+
+        PLATFORMS
+          #{Gem::Platform::RUBY}
+
+        DEPENDENCIES
+          a
+      LOCKFILE
+    end
+
+    rs.load_gemdeps "gem.deps.rb"
+
+    lock_set = rs.sets.find {|set| Gem::Resolver::LockSet === set }
+    refute_nil lock_set, "LockSet should be created from GEM section"
+    assert_equal %w[a-2], lock_set.specs.map(&:full_name)
+
+    assert_equal %w[https://gems.example/ https://other.example/],
+                 lock_set.specs.flat_map {|s| s.sources.map {|src| src.uri.to_s } }
+  end
+
   def test_load_gemdeps_with_lockfile_git_section
     rs = Gem::RequestSet.new