Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Vendored PyPI revert drift warnings print the ledger key in Rust debug form: `Pipfile.lock entry for Some("default:six") changed since vendoring`

Aperta Adatta ai principianti
  • Qualcosa non va?
#1,608 1 commento 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
2/5
Tempo stimato
1-3 ore
Idoneità per principianti
78/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
rust
Ambito
tooling

Direzione di ricerca

L'output errato deriva dalla formattazione {:?} della chiave Option<String> in WiringRecord::key (crates/socket-patch-core/src/vendor/state.rs), usata in pypi_pipenv.rs (vendor_lock_entry_drifted) e pypi_requirements.rs (vendor_revert_line_drifted), con lo stesso schema in pypi_uv.rs e common.rs. Inizia leggendo questi quattro punti di chiamata e l'avviso esistente vendor_revert_residual_reference, che già stampa le chiavi in forma semplice. È completato quando gli avvisi di drift stampano la chiave semplice o un segnaposto per None e i test di revert/rollback continuano a passare.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

agent:triaged bug bughunt pm:pipenv priority:p1

[agent] Found by the scheduled Pipenv bug-hunt routine (ledger #313).

Summary

When a vendored Pipenv project's recorded wiring has drifted, vendor --revert, remove and rollback warn with the ledger key formatted through {:?} on an Option<String>. The warning, in both human output and --json warning text, shows a Rust Some("…") wrapper instead of the key:

Warning: Pipfile.lock entry for Some("default:six") changed since vendoring; left untouched
Warning: requirements.txt: the vendor line for Some("requirements.txt:1") changed since vendoring; left untouched

Impact

This is cosmetic only. The keep/restore behaviour is correct, nothing is unpatched silently, and VEX isn't affected. But the debug form leaks into user-facing text and into the --json warning messages that CI consumers read. When the key is missing (None, e.g. an older or hand-written ledger), the warning would print entry for None.

Repro (Linux, main 657fce2 / 5.0.1, real Pipenv 2026.9.1, local mock of the patch API serving a patched six-1.16.0 wheel)

cat > Pipfile <<'EOF'
[[source]]
url = "https://pypi.org/simple"
verify_ssl = true
name = "pypi"

[packages]
six = "==1.16.0"

[requires]
python_version = "3.11"
EOF
pipenv lock
socket-patch scan --mode vendored --yes          # Pipfile.lock six → ./.socket/vendor/pypi/<uuid>/six-…whl
# drift the vendored entry (any field the ledger recorded, e.g. its markers)
sed -i "s/python_version >= '2.7' and/python_version >= '2.8' and/" Pipfile.lock
socket-patch vendor --revert --yes               # Warning: Pipfile.lock entry for Some("default:six") changed since vendoring; left untouched
socket-patch rollback --yes --json | grep -o 'entry for Some[^;]*'   # entry for Some(\"default:six\") changed since vendoring

The requirements.txt variant: vendor with a sibling requirements.txt holding six==1.16.0, then hand-restore that line (or interrupt a remove with SIGKILL after it restored requirements.txt but before it dropped the ledger) and re-run vendor --revert. It prints the vendor line for Some("requirements.txt:1") changed since vendoring.

Expected vs actual

  • Expected: the warning names the entry as the ledger records it (Pipfile.lock entry for default:six …, the vendor line for requirements.txt:1 …). Other warnings in the same code path print keys plainly, e.g. the vendor_revert_residual_reference text.
  • Actual: Some("default:six") / Some("requirements.txt:1").

OS × version

OS Pipenv vendor --revert rollback remove
Linux 2026.9.1 reproduces (×2) reproduces (×2) reproduces (requirements.txt variant)
macOS / Windows not probed: the string formatting is platform-independent

No bisect, because the format strings predate the current history.

Suspect code

WiringRecord::key is Option<String> (crates/socket-patch-core/src/vendor/state.rs:143), and these format it with {:?}:

  • crates/socket-patch-core/src/vendor/pypi_pipenv.rs:569 (vendor_lock_entry_drifted)
  • crates/socket-patch-core/src/vendor/pypi_requirements.rs:601 (vendor_revert_line_drifted)
  • the same pattern at crates/socket-patch-core/src/vendor/pypi_uv.rs:991 and crates/socket-patch-core/src/vendor/common.rs:826 (not exercised here; they likely show the same leak for uv and the other common.rs users)

A fix along the lines of rec.key.as_deref().unwrap_or("<unknown>") with {} would cover all four.

Lingua principale
Rust
Stelle
8
Fork
1
Merge medio
16h 18m
PR unite (30g)
587

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di SocketDev/socket-patch

Tutte le issue di SocketDev/socket-patch

Issue simili

Altre issue su Rust

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.