Hacktoberfest 2026 : les issues que les mainteneurs ont marquées pour octobre, ouvertes et accessibles aux débutants. Parcourir les issues Hacktoberfest

Vendored scan exits 0 when .gitignore covers `.socket/vendor/state.json`, so the commit silently drops the ledger and every other checkout's `rollback` fails with vendor_ledger_missing

Ouverte
  • Quelque chose ne va pas ?
#1,638 1 commentaire 0 réactions 0 personnes assignées Voir sur GitHub

Les mainteneurs répondent en général sous 1 jour

Personne n'a encore pris cette issue.

Évaluation

Difficulté
3/5
Temps estimé
1-2 jours
Accessibilité débutants
76/100
Type d'issue
Bug
Clarté
Clairement spécifiée
Activité
Active
Stack technique
git, rust
Domaine
cli

Piste de recherche

Start with crates/socket-patch-core/src/vendor/npm_common.rs at npm_tarball_gitignore_preflight and stage_patch_pack, then trace ledger writes through save_state in crates/socket-patch-core/src/vendor/state.rs. Reproduce with the provided pnpm scan and clone flow, checking ignored ledger rules. Done means vendored scan cannot silently succeed while omitting .socket/vendor/state.json, with regression coverage for the reported behavior.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Description

bug bughunt pm:pnpm

[agent] Found by the scheduled pnpm bug-hunt routine (ledger #303).

Summary

Vendored mode checks git's ignore rules for the artifact's uuid directory (vendor_artifact_gitignored, #831 / #1061) and re-includes the tarball against file rules such as *.tgz. It never checks the vendor ledger .socket/vendor/state.json. In a project whose .gitignore matches the ledger (state.json, *.json, **/state.json, …), scan --mode vendored:

  • exits 0 with no warning;
  • prints "Commit .socket/vendor/, package.json, pnpm-lock.yaml, …".

git add .socket then silently leaves state.json out and exits 0. The tarball, its .gitignore, .gitattributes and socket-patch.vendor.json are all committed, so installs still land the patched bytes. Every other checkout (a teammate, CI, a fresh clone) has the lock wiring but no ledger.

Impact

In any checkout other than the one that ran the scan:

  • socket-patch rollback exits 1 with vendor_ledger_missing. Its error text tells you to "restore .socket/vendor/state.json from version control", but version control never had it.
  • socket-patch list says "No patches in this project".
  • vendor --revert gets stuck in the #1072 loop.

The patch can't be undone with the tool anywhere except the original working copy. vex still attests, because the lock wiring and the artifact are present, so nothing points at the missing ledger until someone tries to roll back.

Expected vs actual

  • Expected: docs/usage.md:96 says "Commit .socket/vendor/, including state.json… The ledger stores patch records, artifact fingerprints, and reversal information." docs/development.md:48 says "A ledger is required for repair and managed reversal; discovering a reference is not enough to rebuild it." The artifact gets a pre-write gitignore refusal or a re-include for the same reason. The ledger should get the same protection: re-include it (as <uuid>/.gitignore does for the tarball), or refuse or warn before writing.
  • Actual: exit 0, no warning, and the ledger is silently left out of the commit.

Repro (pnpm 12.14.0, Linux)

# Project with [email protected] and a patch available for it (I used a local mock of the patch API).
mkdir p && cd p && git init -q
echo '{"name":"led","version":"1.0.0","dependencies":{"left-pad":"1.3.0"}}' > package.json
pnpm install
printf 'node_modules\nstate.json\n' > .gitignore
git add -A && git commit -qm init
socket-patch scan --mode vendored          # exit 0, "Vendored 1 package. Commit .socket/vendor/ ..."
git add .socket package.json pnpm-lock.yaml pnpm-workspace.yaml   # exit 0; state.json silently skipped
git commit -qm vendored
git clone -q . ../clone && cd ../clone
pnpm install --frozen-lockfile             # exit 0, patched bytes land
ls .socket/vendor/state.json               # No such file
socket-patch rollback                       # exit 1: vendor_ledger_missing ("restore ... from version control")
socket-patch list                           # "No patches in this project"

OS × version

All cells below are on Linux, Node 22.22.0. Each was run at least twice on main 7d3086f with state.json and *.json rules. The 5.0.1 release was run once per cell.

pnpm socket-patch scan exit / warning ledger in clone clone frozen install clone rollback
9.15.9 main 7d3086f 0 / none missing 0, patched 1, vendor_ledger_missing
10.34.7 main 7d3086f 0 / none missing 0, patched 1
12.14.0 main 7d3086f 0 / none missing 0, patched 1
10.34.7 / 12.14.0 release 5.0.1 (npm) 0 / none missing 0, patched 1

Not bisected. The release 5.0.1 behaves the same, and there is no ledger-path probe anywhere in the code.

Probe runs on macOS and Windows: none. Probe branches are on hold until the stale bughunt/pnpm/* branch can be deleted (see ledger #303). The code path is OS-independent.

Suspect code

  • crates/socket-patch-core/src/vendor/npm_common.rs:226 and :259: npm_tarball_gitignore_preflight / stage_patch_pack probe only format!("{uuid_dir_rel}/").
  • crates/socket-patch-core/src/vendor/state.rs:848 (save_state, path VENDOR_STATE_REL at :44): writes the ledger with no npm_dir::gitignored probe.

This isn't specific to pnpm. Every vendored backend writes the same ledger, so npm, yarn, bun and vlt (and probably maven / nuget) behave the same way. I reproduced it only with pnpm.

Langage dominant
Rust
Étoiles
8
Forks
1
Merge moyen
16 h 22 min
PR mergées (30 j)
583

Préparer son environnement

Par où commencer

  1. Lisez l'issue en entier, puis le guide de contribution du projet.
  2. Signalez en commentaire que vous la prenez — cela évite que deux personnes fassent le même travail.
  3. Forkez le dépôt et travaillez sur une branche.
  4. Ouvrez une pull request qui référence le numéro de l'issue.

Autres issues de SocketDev/socket-patch

Toutes les issues de SocketDev/socket-patch

Issues similaires

Plus d'issues Rust

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.