Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Hosted vlt scan tells users to try --mode vendored for a named-registry package, but vendored always refuses that package with vendor_lock_entry_unsupported

Abierto Apto para principiantes
  • ¿Algo no está bien?
#1,601 2 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
2/5
Tiempo estimado
1-3 horas
Aptitud para principiantes
62/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
rust
Área
cli

Línea de trabajo

La pista engañosa es el texto de detalle redirect_vlt_custom_registry_skipped en crates/socket-patch-core/src/patch/redirect/vlt.rs, alrededor de las líneas 366-371 en rewrite_dep. El rechazo de vendored que la contradice está en crates/socket-patch-core/src/vendor/vlt_lock.rs:2429. Lee ambos y decide si la pista debe nombrar solo el modo agente o indicar que vendored rechaza este paquete. Está hecho cuando la advertencia ya no sugiere vendored para instancias con un registro no predeterminado, con la redacción actualizada donde se construye la advertencia.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

agent:triaged bug bughunt pm:vlt priority:p1

[agent] Found by the scheduled vlt bug-hunt routine (ledger #307).

Summary

A vlt project can install a dependency from a named registry ("left-pad": "acme:[email protected]" with vlt.json registries.acme, DepID [email protected]). A hosted scan skips that package, as documented, with the warning redirect_vlt_custom_registry_skipped, which ends with "(use --mode vendored or agent mode)". Vendored mode then refuses the same package every time: vendor_lock_entry_unsupported, "…not from vlt's default registry; vendoring rewires only default-registry packages". The run exits 1 with partialFailure. Only agent mode works. In my runs it patched the copy and rolled it back cleanly.

Impact

Low severity, but the run sends the user down the wrong path. The remediation hint names a mode that can't succeed. A user (or a CI script that follows the hint) switches to vendored, gets a failed run, and still has the package unpatched. Nothing is written incorrectly: hosted leaves the node alone, and vendored refuses without writing.

Repro (vlt 1.4.0 or 1.3.8, main 657fce2; the string is identical in release 5.0.1)

Use the mock registry / patch API attached to #1494, started three times: PORT=18555, PORT=18556 (patch API) and PORT=18557 (the "acme" registry). Use the env from #1494.

mkdir proj && cd proj
echo '{"name":"root","version":"1.0.0","dependencies":{"left-pad":"acme:[email protected]","right-pad":"1.3.0"}}' > package.json
echo '{"config":{"registries":{"npm":"http://127.0.0.1:18555/","acme":"http://127.0.0.1:18557/"}}}' > vlt.json
vlt install --allow-scripts :scripts
socket-patch scan --mode hosted --yes --json
#  exit 0; left-pad: skipped redirect_unconfirmed
#  warning redirect_vlt_custom_registry_skipped: "... [email protected] left unchanged (use --mode vendored or agent mode)"
socket-patch rollback --yes
socket-patch scan --mode vendored --yes --json
#  exit 1, partialFailure; left-pad: failed vendor_lock_entry_unsupported
#  "vlt-lock.json resolves [email protected] as [email protected], which is not from vlt's default registry; vendoring rewires only default-registry packages"

Agent mode control: scan --mode agent exits 0 and require('left-pad') prints patched; rollback restores pristine.

Expected vs actual
  • Expected: the hint names only modes that can patch the package. docs/ecosystems.md (vlt, "Hosted: the slot rewrite") says such instances stay untouched (redirect_vlt_custom_registry_skipped). The vendored vlt path refuses any non-default-registry instance (vendor/vlt_lock.rs:2429), so the hint should point to agent mode only, or say vendored also refuses it.
  • Actual: "use --mode vendored or agent mode".
OS × version
OS vlt hosted hint vendored agent
Linux 1.4.0 names vendored (2/2) refused (2/2) pass
Linux 1.3.8 names vendored refused (not run)

macOS / Windows: not probed. The message is platform-independent.

The code is the same in release 5.0.1, so this isn't a regression in the current release line. I didn't bisect further.

Suspect code
  • crates/socket-patch-core/src/patch/redirect/vlt.rs:366-371 (rewrite_dep): the redirect_vlt_custom_registry_skipped detail text.
  • crates/socket-patch-core/src/vendor/vlt_lock.rs:2429: the vendored refusal that the hint contradicts.
Lenguaje dominante
Rust
Estrellas
8
Forks
1
Merge medio
16 h 19 min
PR fusionados (30 d)
586

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de SocketDev/socket-patch

Todos los issues de SocketDev/socket-patch

Issues similares

Más issues de Rust

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.