Hacktoberfest 2026: những issue maintainer đã đánh dấu cho tháng Mười, đang mở và phù hợp người mới. Xem issue Hacktoberfest

Vendored scan exits 0 when .gitignore covers `.socket/vendor/state.json`, so the commit silently drops the ledger and every other checkout's `rollback` fails with vendor_ledger_missing

Đang mở
  • Có gì không ổn?
#1,638 1 bình luận 0 reaction 0 người được giao Xem trên GitHub

Maintainer thường phản hồi trong vòng 1 ngày

Chưa có ai nhận issue này.

Đánh giá

Độ khó
3/5
Thời gian dự kiến
1-2 ngày
Mức phù hợp với người mới
76/100
Loại issue
Lỗi
Độ rõ ràng
Đặc tả rõ ràng
Mức độ hoạt động
Sôi nổi
Công nghệ
git, rust
Lĩnh vực
cli

Hướng nghiên cứu

Start with crates/socket-patch-core/src/vendor/npm_common.rs at npm_tarball_gitignore_preflight and stage_patch_pack, then trace ledger writes through save_state in crates/socket-patch-core/src/vendor/state.rs. Reproduce with the provided pnpm scan and clone flow, checking ignored ledger rules. Done means vendored scan cannot silently succeed while omitting .socket/vendor/state.json, with regression coverage for the reported behavior.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.

Mô tả

bug bughunt pm:pnpm

[agent] Found by the scheduled pnpm bug-hunt routine (ledger #303).

Summary

Vendored mode checks git's ignore rules for the artifact's uuid directory (vendor_artifact_gitignored, #831 / #1061) and re-includes the tarball against file rules such as *.tgz. It never checks the vendor ledger .socket/vendor/state.json. In a project whose .gitignore matches the ledger (state.json, *.json, **/state.json, …), scan --mode vendored:

  • exits 0 with no warning;
  • prints "Commit .socket/vendor/, package.json, pnpm-lock.yaml, …".

git add .socket then silently leaves state.json out and exits 0. The tarball, its .gitignore, .gitattributes and socket-patch.vendor.json are all committed, so installs still land the patched bytes. Every other checkout (a teammate, CI, a fresh clone) has the lock wiring but no ledger.

Impact

In any checkout other than the one that ran the scan:

  • socket-patch rollback exits 1 with vendor_ledger_missing. Its error text tells you to "restore .socket/vendor/state.json from version control", but version control never had it.
  • socket-patch list says "No patches in this project".
  • vendor --revert gets stuck in the #1072 loop.

The patch can't be undone with the tool anywhere except the original working copy. vex still attests, because the lock wiring and the artifact are present, so nothing points at the missing ledger until someone tries to roll back.

Expected vs actual

  • Expected: docs/usage.md:96 says "Commit .socket/vendor/, including state.json… The ledger stores patch records, artifact fingerprints, and reversal information." docs/development.md:48 says "A ledger is required for repair and managed reversal; discovering a reference is not enough to rebuild it." The artifact gets a pre-write gitignore refusal or a re-include for the same reason. The ledger should get the same protection: re-include it (as <uuid>/.gitignore does for the tarball), or refuse or warn before writing.
  • Actual: exit 0, no warning, and the ledger is silently left out of the commit.

Repro (pnpm 12.14.0, Linux)

# Project with [email protected] and a patch available for it (I used a local mock of the patch API).
mkdir p && cd p && git init -q
echo '{"name":"led","version":"1.0.0","dependencies":{"left-pad":"1.3.0"}}' > package.json
pnpm install
printf 'node_modules\nstate.json\n' > .gitignore
git add -A && git commit -qm init
socket-patch scan --mode vendored          # exit 0, "Vendored 1 package. Commit .socket/vendor/ ..."
git add .socket package.json pnpm-lock.yaml pnpm-workspace.yaml   # exit 0; state.json silently skipped
git commit -qm vendored
git clone -q . ../clone && cd ../clone
pnpm install --frozen-lockfile             # exit 0, patched bytes land
ls .socket/vendor/state.json               # No such file
socket-patch rollback                       # exit 1: vendor_ledger_missing ("restore ... from version control")
socket-patch list                           # "No patches in this project"

OS × version

All cells below are on Linux, Node 22.22.0. Each was run at least twice on main 7d3086f with state.json and *.json rules. The 5.0.1 release was run once per cell.

pnpm socket-patch scan exit / warning ledger in clone clone frozen install clone rollback
9.15.9 main 7d3086f 0 / none missing 0, patched 1, vendor_ledger_missing
10.34.7 main 7d3086f 0 / none missing 0, patched 1
12.14.0 main 7d3086f 0 / none missing 0, patched 1
10.34.7 / 12.14.0 release 5.0.1 (npm) 0 / none missing 0, patched 1

Not bisected. The release 5.0.1 behaves the same, and there is no ledger-path probe anywhere in the code.

Probe runs on macOS and Windows: none. Probe branches are on hold until the stale bughunt/pnpm/* branch can be deleted (see ledger #303). The code path is OS-independent.

Suspect code

  • crates/socket-patch-core/src/vendor/npm_common.rs:226 and :259: npm_tarball_gitignore_preflight / stage_patch_pack probe only format!("{uuid_dir_rel}/").
  • crates/socket-patch-core/src/vendor/state.rs:848 (save_state, path VENDOR_STATE_REL at :44): writes the ledger with no npm_dir::gitignored probe.

This isn't specific to pnpm. Every vendored backend writes the same ledger, so npm, yarn, bun and vlt (and probably maven / nuget) behave the same way. I reproduced it only with pnpm.

Ngôn ngữ chính
Rust
Star
8
Fork
1
Merge trung bình
16 giờ 22 phút
Pull request đã merge (30 ngày)
583

Chuẩn bị môi trường

Bắt đầu từ đâu

  1. Đọc hết issue, rồi đọc hướng dẫn đóng góp của dự án.
  2. Bình luận trên issue rằng bạn sẽ nhận — tránh hai người làm cùng một việc.
  3. Fork repository và làm thay đổi trên một nhánh.
  4. Mở pull request có tham chiếu số hiệu của issue.

Issue khác của SocketDev/socket-patch

Tất cả issue của SocketDev/socket-patch

Issue tương tự

Thêm issue về Rust

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.