Hacktoberfest 2026: những issue maintainer đã đánh dấu cho tháng Mười, đang mở và phù hợp người mới. Xem issue Hacktoberfest

VEX product detection fails on Poetry 2 projects that declare dynamic = ["version"] with the version in [tool.poetry], so scan --vex exits 1 after rewriting poetry.lock

Đã đóng
  • Có gì không ổn?
#1,527 3 bình luận 0 reaction 0 người được giao Xem trên GitHub

Maintainer thường phản hồi trong vòng 1 ngày

Một pull request liên quan đã được merge.

  • #1529 của @mikolalysenko — đã merge

Đánh giá

Độ khó
3/5
Thời gian dự kiến
Nửa ngày
Mức phù hợp với người mới
25/100
Loại issue
Lỗi
Độ rõ ràng
Đặc tả rõ ràng
Mức độ hoạt động
Đình trệ
Công nghệ
python, rust
Lĩnh vực
cli

Hướng nghiên cứu

Start in crates/socket-patch-core/src/vex/product.rs, at parse_pyproject and scan_toml_section, to see why name and version must come from one section. Reproduce with the layout in the issue, then run socket-patch vex -O v.json in a directory with no git origin. Done when that command yields pkg:pypi/[email protected] without --product. The test pattern is in crates/socket-patch-cli/tests/in_process_redirect_poetry.rs. Linked PR #1529 is already open against this bug.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.

Mô tả

agent:claimed agent:triaged bug bughunt pm:poetry priority:p1

[agent] Found by the scheduled Poetry bug-hunt routine (ledger #311).

Summary

Poetry 2 documents a PEP 621 layout where [project] has name and dynamic = ["version"], and the version is in [tool.poetry] version (see https://python-poetry.org/docs/pyproject/#version). poetry check, poetry version and poetry build all accept it (demo 0.3.0, demo-0.3.0-py3-none-any.whl).

vex/product.rs::parse_pyproject reads name and version from one section only. It tries [project], which has no version, and then [tool.poetry], which has no name. Both return None, so no product is detected:

  • socket-patch vex -O out.json exits 2 with product_undetected ("pyproject.toml was found but has no usable name and version").
  • socket-patch scan --mode hosted --vex out.json exits 1 with product_undetected, after it has already rewritten poetry.lock to the hosted pin. No VEX document is written.

This happens whenever the product falls through to the manifest probe, which means a checkout with no git origin remote (for example a source tarball or an exported tree). A git remote takes priority in detect_product.

This isn't the same as #642. That issue is about a missing [tool.pdm] fallback. Here both sections are read, but their keys are never combined.

Impact

  • Any Poetry 2 project that uses the documented dynamic-version layout gets no VEX unless the user passes --product by hand, and scan --vex turns a successful hosted rewrite into a failed command (exit 1) in CI.
  • The lock rewrite is still committed, so a retry without --vex has nothing left to do, and the failure looks like a broken scan.

Repro (Linux, Poetry 2.0.1 / 2.2.1 / 2.5.1, no git checkout)

A local mock of the patch API serves a hosted patch for pkg:pypi/[email protected] (same routes as crates/socket-patch-cli/tests/in_process_redirect_poetry.rs). Any patched dependency would do.

mkdir demo-proj && cd demo-proj && mkdir demo && touch demo/__init__.py
cat > pyproject.toml <<'EOF'
[project]
name = "demo"
dynamic = ["version"]
requires-python = ">=3.9"
dependencies = ["six==1.16.0"]

[tool.poetry]
version = "0.3.0"

[build-system]
requires = ["poetry-core>=2.0.0"]
build-backend = "poetry.core.masonry.api"
EOF
poetry check          # All set!
poetry version        # demo 0.3.0
poetry lock
socket-patch scan --mode hosted --json --vex out.vex.json
#  exit 1, status "error", error.code "product_undetected"
#  poetry.lock now carries the hosted pin; out.vex.json not written
socket-patch vex -O v.json                               # exit 2, product_undetected
socket-patch vex -O v.json --product pkg:pypi/[email protected] # exit 0 (workaround)

Control: with version = "0.3.0" in [project] (no dynamic, no [tool.poetry]), scan --mode hosted --vex exits 0 and the product is pkg:pypi/[email protected].

Expected vs actual

  • Expected: vex --help documents auto-detection from "pyproject.toml: pkg:pypi/@". For a project Poetry itself builds as demo 0.3.0, the product should be pkg:pypi/[email protected]: [project].name, plus the [tool.poetry].version that Poetry uses when version is listed in [project].dynamic. CLI_CONTRACT.md ("Fail-the-command") says scan --vex exits non-zero when the product is undetectable, but here it can be detected.
  • Actual: product_undetected. vex exits 2, and scan --vex exits 1 after it has written the lock.

OS × version

OS Poetry Result
Linux 2.0.1 fail (2/2)
Linux 2.2.1 fail
Linux 2.5.1 fail (2/2)
Linux 2.5.1, static [project].version (control) pass
macOS / Windows any untested. The code path doesn't depend on the OS (pure TOML text scan).

Poetry 1.x ignores [project], so the layout only applies to Poetry ≥ 2.0.

Suspect code

  • crates/socket-patch-core/src/vex/product.rs:157-165 (parse_pyproject): scan_toml_section(content, "project").or_else(|| scan_toml_section(content, "tool.poetry")) needs both keys from the same section. When [project] has a name and dynamic contains "version", it should take the version from [tool.poetry].
  • crates/socket-patch-core/src/vex/product.rs:368 (scan_toml_section) returns nothing unless both keys are present.

Main 6a06ddd. No probe runs: probe branches are still blocked for this routine (see ledger #311).

Ngôn ngữ chính
Rust
Star
8
Fork
1
Merge trung bình
16 giờ 18 phút
Pull request đã merge (30 ngày)
587

Chuẩn bị môi trường

Bắt đầu từ đâu

  1. Đọc hết issue, rồi đọc hướng dẫn đóng góp của dự án.
  2. Bình luận trên issue rằng bạn sẽ nhận — tránh hai người làm cùng một việc.
  3. Fork repository và làm thay đổi trên một nhánh.
  4. Mở pull request có tham chiếu số hiệu của issue.

Issue khác của SocketDev/socket-patch

Tất cả issue của SocketDev/socket-patch

Issue tương tự

Thêm issue về Rust

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.