Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Vendored scan exits 0 when .gitignore covers `.socket/vendor/state.json`, so the commit silently drops the ledger and every other checkout's `rollback` fails with vendor_ledger_missing

Abierto
  • ¿Algo no está bien?
#1,638 1 comentario 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
3/5
Tiempo estimado
1-2 días
Aptitud para principiantes
76/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
git, rust
Área
cli

Línea de trabajo

Start with crates/socket-patch-core/src/vendor/npm_common.rs at npm_tarball_gitignore_preflight and stage_patch_pack, then trace ledger writes through save_state in crates/socket-patch-core/src/vendor/state.rs. Reproduce with the provided pnpm scan and clone flow, checking ignored ledger rules. Done means vendored scan cannot silently succeed while omitting .socket/vendor/state.json, with regression coverage for the reported behavior.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

bug bughunt pm:pnpm

[agent] Found by the scheduled pnpm bug-hunt routine (ledger #303).

Summary

Vendored mode checks git's ignore rules for the artifact's uuid directory (vendor_artifact_gitignored, #831 / #1061) and re-includes the tarball against file rules such as *.tgz. It never checks the vendor ledger .socket/vendor/state.json. In a project whose .gitignore matches the ledger (state.json, *.json, **/state.json, …), scan --mode vendored:

  • exits 0 with no warning;
  • prints "Commit .socket/vendor/, package.json, pnpm-lock.yaml, …".

git add .socket then silently leaves state.json out and exits 0. The tarball, its .gitignore, .gitattributes and socket-patch.vendor.json are all committed, so installs still land the patched bytes. Every other checkout (a teammate, CI, a fresh clone) has the lock wiring but no ledger.

Impact

In any checkout other than the one that ran the scan:

  • socket-patch rollback exits 1 with vendor_ledger_missing. Its error text tells you to "restore .socket/vendor/state.json from version control", but version control never had it.
  • socket-patch list says "No patches in this project".
  • vendor --revert gets stuck in the #1072 loop.

The patch can't be undone with the tool anywhere except the original working copy. vex still attests, because the lock wiring and the artifact are present, so nothing points at the missing ledger until someone tries to roll back.

Expected vs actual

  • Expected: docs/usage.md:96 says "Commit .socket/vendor/, including state.json… The ledger stores patch records, artifact fingerprints, and reversal information." docs/development.md:48 says "A ledger is required for repair and managed reversal; discovering a reference is not enough to rebuild it." The artifact gets a pre-write gitignore refusal or a re-include for the same reason. The ledger should get the same protection: re-include it (as <uuid>/.gitignore does for the tarball), or refuse or warn before writing.
  • Actual: exit 0, no warning, and the ledger is silently left out of the commit.

Repro (pnpm 12.14.0, Linux)

# Project with [email protected] and a patch available for it (I used a local mock of the patch API).
mkdir p && cd p && git init -q
echo '{"name":"led","version":"1.0.0","dependencies":{"left-pad":"1.3.0"}}' > package.json
pnpm install
printf 'node_modules\nstate.json\n' > .gitignore
git add -A && git commit -qm init
socket-patch scan --mode vendored          # exit 0, "Vendored 1 package. Commit .socket/vendor/ ..."
git add .socket package.json pnpm-lock.yaml pnpm-workspace.yaml   # exit 0; state.json silently skipped
git commit -qm vendored
git clone -q . ../clone && cd ../clone
pnpm install --frozen-lockfile             # exit 0, patched bytes land
ls .socket/vendor/state.json               # No such file
socket-patch rollback                       # exit 1: vendor_ledger_missing ("restore ... from version control")
socket-patch list                           # "No patches in this project"

OS × version

All cells below are on Linux, Node 22.22.0. Each was run at least twice on main 7d3086f with state.json and *.json rules. The 5.0.1 release was run once per cell.

pnpm socket-patch scan exit / warning ledger in clone clone frozen install clone rollback
9.15.9 main 7d3086f 0 / none missing 0, patched 1, vendor_ledger_missing
10.34.7 main 7d3086f 0 / none missing 0, patched 1
12.14.0 main 7d3086f 0 / none missing 0, patched 1
10.34.7 / 12.14.0 release 5.0.1 (npm) 0 / none missing 0, patched 1

Not bisected. The release 5.0.1 behaves the same, and there is no ledger-path probe anywhere in the code.

Probe runs on macOS and Windows: none. Probe branches are on hold until the stale bughunt/pnpm/* branch can be deleted (see ledger #303). The code path is OS-independent.

Suspect code

  • crates/socket-patch-core/src/vendor/npm_common.rs:226 and :259: npm_tarball_gitignore_preflight / stage_patch_pack probe only format!("{uuid_dir_rel}/").
  • crates/socket-patch-core/src/vendor/state.rs:848 (save_state, path VENDOR_STATE_REL at :44): writes the ledger with no npm_dir::gitignored probe.

This isn't specific to pnpm. Every vendored backend writes the same ledger, so npm, yarn, bun and vlt (and probably maven / nuget) behave the same way. I reproduced it only with pnpm.

Lenguaje dominante
Rust
Estrellas
8
Forks
1
Merge medio
16 h 16 min
PR fusionados (30 d)
582

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de SocketDev/socket-patch

Todos los issues de SocketDev/socket-patch

Issues similares

Más issues de Rust

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.