Hacktoberfest 2026: as issues que os mantenedores marcaram para outubro, abertas e boas para iniciantes. Ver issues do Hacktoberfest

Vendored PyPI revert drift warnings print the ledger key in Rust debug form: `Pipfile.lock entry for Some("default:six") changed since vendoring`

Aberta Para iniciantes
  • Algo errado?
#1,608 1 comentário 0 reações 0 responsáveis Ver no GitHub

Mantenedores costumam responder em até 1 dia

Ninguém assumiu esta issue ainda.

Avaliação

Dificuldade
2/5
Tempo estimado
1-3 horas
Facilidade para iniciantes
78/100
Tipo de issue
Bug
Clareza
Claramente especificada
Status de atividade
Ativa
Stack de tecnologia
rust
Domínio
tooling

Direção de pesquisa

A saída incorreta vem da formatação {:?} da chave Option<String> em WiringRecord::key (crates/socket-patch-core/src/vendor/state.rs), usada em pypi_pipenv.rs (vendor_lock_entry_drifted) e pypi_requirements.rs (vendor_revert_line_drifted), com o mesmo padrão em pypi_uv.rs e common.rs. Comece lendo esses quatro pontos de chamada e o aviso existente vendor_revert_residual_reference, que já imprime as chaves de forma simples. Está pronto quando os avisos de drift imprimem a chave simples ou um marcador para None, e os testes de revert/rollback continuam passando.

Escrita pelo modelo de indexação a partir do texto da issue.

Descrição

agent:triaged bug bughunt pm:pipenv priority:p1

[agent] Found by the scheduled Pipenv bug-hunt routine (ledger #313).

Summary

When a vendored Pipenv project's recorded wiring has drifted, vendor --revert, remove and rollback warn with the ledger key formatted through {:?} on an Option<String>. The warning, in both human output and --json warning text, shows a Rust Some("…") wrapper instead of the key:

Warning: Pipfile.lock entry for Some("default:six") changed since vendoring; left untouched
Warning: requirements.txt: the vendor line for Some("requirements.txt:1") changed since vendoring; left untouched

Impact

This is cosmetic only. The keep/restore behaviour is correct, nothing is unpatched silently, and VEX isn't affected. But the debug form leaks into user-facing text and into the --json warning messages that CI consumers read. When the key is missing (None, e.g. an older or hand-written ledger), the warning would print entry for None.

Repro (Linux, main 657fce2 / 5.0.1, real Pipenv 2026.9.1, local mock of the patch API serving a patched six-1.16.0 wheel)

cat > Pipfile <<'EOF'
[[source]]
url = "https://pypi.org/simple"
verify_ssl = true
name = "pypi"

[packages]
six = "==1.16.0"

[requires]
python_version = "3.11"
EOF
pipenv lock
socket-patch scan --mode vendored --yes          # Pipfile.lock six → ./.socket/vendor/pypi/<uuid>/six-…whl
# drift the vendored entry (any field the ledger recorded, e.g. its markers)
sed -i "s/python_version >= '2.7' and/python_version >= '2.8' and/" Pipfile.lock
socket-patch vendor --revert --yes               # Warning: Pipfile.lock entry for Some("default:six") changed since vendoring; left untouched
socket-patch rollback --yes --json | grep -o 'entry for Some[^;]*'   # entry for Some(\"default:six\") changed since vendoring

The requirements.txt variant: vendor with a sibling requirements.txt holding six==1.16.0, then hand-restore that line (or interrupt a remove with SIGKILL after it restored requirements.txt but before it dropped the ledger) and re-run vendor --revert. It prints the vendor line for Some("requirements.txt:1") changed since vendoring.

Expected vs actual

  • Expected: the warning names the entry as the ledger records it (Pipfile.lock entry for default:six …, the vendor line for requirements.txt:1 …). Other warnings in the same code path print keys plainly, e.g. the vendor_revert_residual_reference text.
  • Actual: Some("default:six") / Some("requirements.txt:1").

OS × version

OS Pipenv vendor --revert rollback remove
Linux 2026.9.1 reproduces (×2) reproduces (×2) reproduces (requirements.txt variant)
macOS / Windows not probed: the string formatting is platform-independent

No bisect, because the format strings predate the current history.

Suspect code

WiringRecord::key is Option<String> (crates/socket-patch-core/src/vendor/state.rs:143), and these format it with {:?}:

  • crates/socket-patch-core/src/vendor/pypi_pipenv.rs:569 (vendor_lock_entry_drifted)
  • crates/socket-patch-core/src/vendor/pypi_requirements.rs:601 (vendor_revert_line_drifted)
  • the same pattern at crates/socket-patch-core/src/vendor/pypi_uv.rs:991 and crates/socket-patch-core/src/vendor/common.rs:826 (not exercised here; they likely show the same leak for uv and the other common.rs users)

A fix along the lines of rec.key.as_deref().unwrap_or("<unknown>") with {} would cover all four.

Linguagem predominante
Rust
Estrelas
8
Forks
1
Merge médio
16h 18min
PRs com merge (30d)
587

Preparar o ambiente

Primeiros passos

  1. Leia a issue inteira e depois o guia de contribuição do projeto.
  2. Comente na issue dizendo que vai assumir — evita que duas pessoas façam o mesmo trabalho.
  3. Faça um fork do repositório e trabalhe em uma branch.
  4. Abra um pull request que referencie o número da issue.

Mais de SocketDev/socket-patch

Todas as issues de SocketDev/socket-patch

Issues semelhantes

Mais issues de Rust

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.