Hacktoberfest 2026: die Issues, die Maintainer für den Oktober markiert haben – offen und einsteigerfreundlich. Hacktoberfest-Issues durchsuchen

Vendored scan exits 0 when .gitignore covers `.socket/vendor/state.json`, so the commit silently drops the ledger and every other checkout's `rollback` fails with vendor_ledger_missing

Offen
  • Stimmt etwas nicht?
#1,638 1 Kommentar 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen

Maintainer antworten meist innerhalb von 1 Tag

Dieses Issue hat noch niemand übernommen.

Bewertung

Schwierigkeit
3/5
Geschätzter Aufwand
1-2 Tage
Anfängerfreundlichkeit
76/100
Issue-Typ
Bug
Klarheit
Klar beschrieben
Aktivitätsstatus
Aktiv
Tech-Stack
git, rust
Bereich
cli

Rechercherichtung

Start with crates/socket-patch-core/src/vendor/npm_common.rs at npm_tarball_gitignore_preflight and stage_patch_pack, then trace ledger writes through save_state in crates/socket-patch-core/src/vendor/state.rs. Reproduce with the provided pnpm scan and clone flow, checking ignored ledger rules. Done means vendored scan cannot silently succeed while omitting .socket/vendor/state.json, with regression coverage for the reported behavior.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Beschreibung

bug bughunt pm:pnpm

[agent] Found by the scheduled pnpm bug-hunt routine (ledger #303).

Summary

Vendored mode checks git's ignore rules for the artifact's uuid directory (vendor_artifact_gitignored, #831 / #1061) and re-includes the tarball against file rules such as *.tgz. It never checks the vendor ledger .socket/vendor/state.json. In a project whose .gitignore matches the ledger (state.json, *.json, **/state.json, …), scan --mode vendored:

  • exits 0 with no warning;
  • prints "Commit .socket/vendor/, package.json, pnpm-lock.yaml, …".

git add .socket then silently leaves state.json out and exits 0. The tarball, its .gitignore, .gitattributes and socket-patch.vendor.json are all committed, so installs still land the patched bytes. Every other checkout (a teammate, CI, a fresh clone) has the lock wiring but no ledger.

Impact

In any checkout other than the one that ran the scan:

  • socket-patch rollback exits 1 with vendor_ledger_missing. Its error text tells you to "restore .socket/vendor/state.json from version control", but version control never had it.
  • socket-patch list says "No patches in this project".
  • vendor --revert gets stuck in the #1072 loop.

The patch can't be undone with the tool anywhere except the original working copy. vex still attests, because the lock wiring and the artifact are present, so nothing points at the missing ledger until someone tries to roll back.

Expected vs actual

  • Expected: docs/usage.md:96 says "Commit .socket/vendor/, including state.json… The ledger stores patch records, artifact fingerprints, and reversal information." docs/development.md:48 says "A ledger is required for repair and managed reversal; discovering a reference is not enough to rebuild it." The artifact gets a pre-write gitignore refusal or a re-include for the same reason. The ledger should get the same protection: re-include it (as <uuid>/.gitignore does for the tarball), or refuse or warn before writing.
  • Actual: exit 0, no warning, and the ledger is silently left out of the commit.

Repro (pnpm 12.14.0, Linux)

# Project with [email protected] and a patch available for it (I used a local mock of the patch API).
mkdir p && cd p && git init -q
echo '{"name":"led","version":"1.0.0","dependencies":{"left-pad":"1.3.0"}}' > package.json
pnpm install
printf 'node_modules\nstate.json\n' > .gitignore
git add -A && git commit -qm init
socket-patch scan --mode vendored          # exit 0, "Vendored 1 package. Commit .socket/vendor/ ..."
git add .socket package.json pnpm-lock.yaml pnpm-workspace.yaml   # exit 0; state.json silently skipped
git commit -qm vendored
git clone -q . ../clone && cd ../clone
pnpm install --frozen-lockfile             # exit 0, patched bytes land
ls .socket/vendor/state.json               # No such file
socket-patch rollback                       # exit 1: vendor_ledger_missing ("restore ... from version control")
socket-patch list                           # "No patches in this project"

OS × version

All cells below are on Linux, Node 22.22.0. Each was run at least twice on main 7d3086f with state.json and *.json rules. The 5.0.1 release was run once per cell.

pnpm socket-patch scan exit / warning ledger in clone clone frozen install clone rollback
9.15.9 main 7d3086f 0 / none missing 0, patched 1, vendor_ledger_missing
10.34.7 main 7d3086f 0 / none missing 0, patched 1
12.14.0 main 7d3086f 0 / none missing 0, patched 1
10.34.7 / 12.14.0 release 5.0.1 (npm) 0 / none missing 0, patched 1

Not bisected. The release 5.0.1 behaves the same, and there is no ledger-path probe anywhere in the code.

Probe runs on macOS and Windows: none. Probe branches are on hold until the stale bughunt/pnpm/* branch can be deleted (see ledger #303). The code path is OS-independent.

Suspect code

  • crates/socket-patch-core/src/vendor/npm_common.rs:226 and :259: npm_tarball_gitignore_preflight / stage_patch_pack probe only format!("{uuid_dir_rel}/").
  • crates/socket-patch-core/src/vendor/state.rs:848 (save_state, path VENDOR_STATE_REL at :44): writes the ledger with no npm_dir::gitignored probe.

This isn't specific to pnpm. Every vendored backend writes the same ledger, so npm, yarn, bun and vlt (and probably maven / nuget) behave the same way. I reproduced it only with pnpm.

Vorherrschende Sprache
Rust
Sterne
8
Forks
1
Ø Merge
16 Std. 22 Min.
Gemergte PRs (30 T.)
583

Entwicklungsumgebung

Erste Schritte

  1. Lesen Sie das ganze Issue und danach den Beitragsleitfaden des Projekts.
  2. Schreiben Sie ins Issue, dass Sie es übernehmen — das erspart doppelte Arbeit.
  3. Forken Sie das Repository und arbeiten Sie in einem Branch.
  4. Öffnen Sie einen Pull Request, der die Issue-Nummer nennt.

Mehr aus SocketDev/socket-patch

Alle Issues in SocketDev/socket-patch

Ähnliche Issues

Weitere Issues zu Rust

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.