Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Vendored scan exits 0 when .gitignore covers `.socket/vendor/state.json`, so the commit silently drops the ledger and every other checkout's `rollback` fails with vendor_ledger_missing

Aperta
  • Qualcosa non va?
#1,638 1 commento 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
3/5
Tempo stimato
1-2 giorni
Idoneità per principianti
76/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
git, rust
Ambito
cli

Direzione di ricerca

Start with crates/socket-patch-core/src/vendor/npm_common.rs at npm_tarball_gitignore_preflight and stage_patch_pack, then trace ledger writes through save_state in crates/socket-patch-core/src/vendor/state.rs. Reproduce with the provided pnpm scan and clone flow, checking ignored ledger rules. Done means vendored scan cannot silently succeed while omitting .socket/vendor/state.json, with regression coverage for the reported behavior.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

bug bughunt pm:pnpm

[agent] Found by the scheduled pnpm bug-hunt routine (ledger #303).

Summary

Vendored mode checks git's ignore rules for the artifact's uuid directory (vendor_artifact_gitignored, #831 / #1061) and re-includes the tarball against file rules such as *.tgz. It never checks the vendor ledger .socket/vendor/state.json. In a project whose .gitignore matches the ledger (state.json, *.json, **/state.json, …), scan --mode vendored:

  • exits 0 with no warning;
  • prints "Commit .socket/vendor/, package.json, pnpm-lock.yaml, …".

git add .socket then silently leaves state.json out and exits 0. The tarball, its .gitignore, .gitattributes and socket-patch.vendor.json are all committed, so installs still land the patched bytes. Every other checkout (a teammate, CI, a fresh clone) has the lock wiring but no ledger.

Impact

In any checkout other than the one that ran the scan:

  • socket-patch rollback exits 1 with vendor_ledger_missing. Its error text tells you to "restore .socket/vendor/state.json from version control", but version control never had it.
  • socket-patch list says "No patches in this project".
  • vendor --revert gets stuck in the #1072 loop.

The patch can't be undone with the tool anywhere except the original working copy. vex still attests, because the lock wiring and the artifact are present, so nothing points at the missing ledger until someone tries to roll back.

Expected vs actual

  • Expected: docs/usage.md:96 says "Commit .socket/vendor/, including state.json… The ledger stores patch records, artifact fingerprints, and reversal information." docs/development.md:48 says "A ledger is required for repair and managed reversal; discovering a reference is not enough to rebuild it." The artifact gets a pre-write gitignore refusal or a re-include for the same reason. The ledger should get the same protection: re-include it (as <uuid>/.gitignore does for the tarball), or refuse or warn before writing.
  • Actual: exit 0, no warning, and the ledger is silently left out of the commit.

Repro (pnpm 12.14.0, Linux)

# Project with [email protected] and a patch available for it (I used a local mock of the patch API).
mkdir p && cd p && git init -q
echo '{"name":"led","version":"1.0.0","dependencies":{"left-pad":"1.3.0"}}' > package.json
pnpm install
printf 'node_modules\nstate.json\n' > .gitignore
git add -A && git commit -qm init
socket-patch scan --mode vendored          # exit 0, "Vendored 1 package. Commit .socket/vendor/ ..."
git add .socket package.json pnpm-lock.yaml pnpm-workspace.yaml   # exit 0; state.json silently skipped
git commit -qm vendored
git clone -q . ../clone && cd ../clone
pnpm install --frozen-lockfile             # exit 0, patched bytes land
ls .socket/vendor/state.json               # No such file
socket-patch rollback                       # exit 1: vendor_ledger_missing ("restore ... from version control")
socket-patch list                           # "No patches in this project"

OS × version

All cells below are on Linux, Node 22.22.0. Each was run at least twice on main 7d3086f with state.json and *.json rules. The 5.0.1 release was run once per cell.

pnpm socket-patch scan exit / warning ledger in clone clone frozen install clone rollback
9.15.9 main 7d3086f 0 / none missing 0, patched 1, vendor_ledger_missing
10.34.7 main 7d3086f 0 / none missing 0, patched 1
12.14.0 main 7d3086f 0 / none missing 0, patched 1
10.34.7 / 12.14.0 release 5.0.1 (npm) 0 / none missing 0, patched 1

Not bisected. The release 5.0.1 behaves the same, and there is no ledger-path probe anywhere in the code.

Probe runs on macOS and Windows: none. Probe branches are on hold until the stale bughunt/pnpm/* branch can be deleted (see ledger #303). The code path is OS-independent.

Suspect code

  • crates/socket-patch-core/src/vendor/npm_common.rs:226 and :259: npm_tarball_gitignore_preflight / stage_patch_pack probe only format!("{uuid_dir_rel}/").
  • crates/socket-patch-core/src/vendor/state.rs:848 (save_state, path VENDOR_STATE_REL at :44): writes the ledger with no npm_dir::gitignored probe.

This isn't specific to pnpm. Every vendored backend writes the same ledger, so npm, yarn, bun and vlt (and probably maven / nuget) behave the same way. I reproduced it only with pnpm.

Lingua principale
Rust
Stelle
8
Fork
1
Merge medio
16h 22m
PR unite (30g)
583

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di SocketDev/socket-patch

Tutte le issue di SocketDev/socket-patch

Issue simili

Altre issue su Rust

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.