Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

VEX gemspec product detection reads commented-out `# spec.name =` / `# spec.version =` lines, so the document names the wrong product or version

Abierto Apto para principiantes
  • ¿Algo no está bien?
#1,573 1 comentario 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
2/5
Tiempo estimado
1-3 horas
Aptitud para principiantes
70/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
ruby, rust
Área
security

Línea de trabajo

El parser de gemspec es parse_gemspec en crates/socket-patch-core/src/vex/product.rs (líneas ~363-380), y la sonda 9 está documentada en vex.rs alrededor de la línea 66. Lee primero la clausura literal, luego pasa por ella los dos gemspecs de reproducción del issue para confirmar que las líneas comentadas # spec.version = y # spec.name = coinciden. Se considera terminado cuando ambos archivos producen pkg:gem/acme con la versión calculada descartada, y una prueba de regresión cubre el caso de líneas comentadas.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

agent:triaged bug bughunt pm:bundler priority:p1

[agent] Found by the scheduled Bundler (RubyGems) bug-hunt routine (ledger #316).

Summary

vex (and scan/apply/vendor --vex without --vex-product) names the top-level product of a gem library project from its root *.gemspec (parse_gemspec, probe 9). The parser takes the first line whose =-left side ends in .name / .version and whose right side starts with a quote. It never skips Ruby comments, so a commented-out assignment wins over the live one:

  • # spec.version = "0.0.1" above spec.version = Acme::VERSION → product pkg:gem/[email protected] (the real version is 2.3.4; a computed version should be dropped, giving pkg:gem/acme).
  • # spec.name = "acme-legacy" above spec.name = "acme" → product pkg:gem/acme-legacy.

No warning is printed. Ruby (Gem::Specification.load) gives acme-2.3.4 for both files.

Impact

The OpenVEX document's products[].@id names a product or version that doesn't exist, so consumers that match VEX statements to their SBOM by product purl won't apply them (or will apply them to the wrong release). The run reports success. Leaving old assignments commented out is a common edit when a gem moves its version into a VERSION constant, or after a gem is renamed.

Repro (Linux, Ruby 3.3.6, Bundler 2.5.22 / 4.0.18; main e76cb9b)

mkdir -p acme/lib/acme && cd acme
echo 'module Acme; VERSION = "2.3.4"; end' > lib/acme/version.rb
cat > acme.gemspec <<'E'
require_relative "lib/acme/version"
Gem::Specification.new do |spec|
  spec.name = "acme"
  # spec.version = "0.0.1" # pinned before the VERSION constant existed
  spec.version = Acme::VERSION
  spec.authors = ["x"]
  spec.summary = "x"
  spec.files = []
  spec.add_dependency "colorize", "0.8.1"
end
E
printf 'source "https://rubygems.org"\ngemspec\n' > Gemfile
bundle install
# any applied gem patch in .socket/manifest.json (hand-written [email protected] manifest + `apply --offline` here)
socket-patch apply --offline
socket-patch vex | grep '"@id": "pkg:gem/acme'
#   "@id": "pkg:gem/[email protected]"
ruby -e 'puts Gem::Specification.load("acme.gemspec").full_name'
#   acme-2.3.4

The name variant: put # spec.name = "acme-legacy" above Gem::Specification.new (and drop the commented version). vex then gives "@id": "pkg:gem/acme-legacy". Each shape reproduced twice.

Expected vs actual

  • Expected: parse_gemspec's own doc says the product comes "from literal <spec>.name = "…" / <spec>.version = "…" assignments; a version computed from a constant (Foo::VERSION) is dropped" (crates/socket-patch-core/src/vex/product.rs:363-366). A comment is not an assignment, so this file should give pkg:gem/acme (version dropped). vex.rs:66 documents probe 9 as pkg:gem/<name>[@<version>].
  • Actual: pkg:gem/[email protected] / pkg:gem/acme-legacy.

Matrix

OS Ruby / Bundler Commented version Commented name
Linux (sandbox) 3.3.6 / 2.5.22 reproduces (×2) reproduces (×2)

The parser is OS- and Bundler-independent (pure text), so macOS / Windows aren't probed.

Suspect code

crates/socket-patch-core/src/vex/product.rs:367-380: the literal closure trims the line and checks lhs.ends_with(".name") without first dropping lines that start with # (or text after a # outside a string). =begin/=end blocks and heredocs are also read as code, though those are rarer.

First bad version: not bisected (the sandbox clone is shallow). parse_gemspec has had this shape since gemspec detection was added.

Lenguaje dominante
Rust
Estrellas
8
Forks
1
Merge medio
16 h 35 min
PR fusionados (30 d)
574

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de SocketDev/socket-patch

Todos los issues de SocketDev/socket-patch

Issues similares

Más issues de Rust

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.