Hacktoberfest 2026: những issue maintainer đã đánh dấu cho tháng Mười, đang mở và phù hợp người mới. Xem issue Hacktoberfest

Agent-mode Go rollback and remove after `go mod tidy` drop the replace but not restore the module's go.sum lines, so the next default `go build` fails with "missing go.sum entry" while rollback exits 0 with no warning

Đang mở
  • Có gì không ổn?
#549 1 bình luận 0 reaction 0 người được giao Xem trên GitHub

Maintainer thường phản hồi trong vòng 1 ngày

Chưa có ai nhận issue này.

Đánh giá

Độ khó
4/5
Thời gian dự kiến
3-5 ngày
Mức phù hợp với người mới
74/100
Loại issue
Lỗi
Độ rõ ràng
Đặc tả rõ ràng
Mức độ hoạt động
Sôi nổi
Công nghệ
go, rust
Lĩnh vực
cli, devtools

Hướng nghiên cứu

Start in crates/socket-patch-core/src/patch/redirect/golang_local.rs at remove_go_redirect and follow go_mod_edit::drop_replace_entry in crates/socket-patch-core/src/vendor/go_mod_edit.rs. Compare the hosted-takeover handling in crates/socket-patch-core/src/vendor/golang.rs:364-377, then reproduce apply → go mod tidy → rollback/remove with the hermetic setup. Done means rollback and remove restore the module's go.sum entries or clearly report the required follow-up, and the default go build succeeds.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.

Mô tả

agent:triaged bug bughunt pm:go priority:p2

[agent] Found by the scheduled Go modules bug-hunt routine (ledger #317).

Summary

In agent mode, apply points the patched module at .socket/go-patches/<module>@<version>/ with a directory replace. Go doesn't need go.sum lines for a directory replace, so go mod tidy removes the original module's h1: lines from go.sum. docs/ecosystems.md says "the wiring survives go mod tidy", so running tidy after apply is a supported workflow.

rollback (and remove <purl>) then drops the replace and the copy but leaves go.sum as tidy left it. The result is a go.mod that requires the module with no go.sum entry. The next go build with default flags (-mod=readonly) fails with missing go.sum entry for module providing package …. Rollback still reports status: success with warnings: [].

Impact

After a routine socket-patch rollback or remove, every CI build and every fresh go build/go test is red until someone runs go mod tidy or go get by hand. Nothing in the output says this is needed. Other paths already handle this:

  • The hosted leg re-resolves and restores the original module's go.sum lines.
  • The hosted→vendored takeover warns that go mod tidy will be needed after vendor --revert (vendor/golang.rs ~L364).

The agent leg does neither.

Repro (hermetic, Linux, go 1.24.7)

SP=/path/to/target/release/socket-patch
W=$(mktemp -d); M=example.com/upstream; V=v1.0.0
mkdir -p $W/stage/$M@$V $W/proxy/$M/@v $W/c/.socket/blobs
printf 'module %s\n\ngo 1.21\n' $M > $W/stage/$M@$V/go.mod
printf 'package upstream\n\nfunc Greeting() string { return "PRISTINE" }\n' > $W/stage/$M@$V/lib.go
printf 'package upstream\n\nfunc Greeting() string { return "PATCHED" }\n' > $W/patched.go
echo "{\"Version\":\"$V\"}" > $W/proxy/$M/@v/$V.info; cp $W/stage/$M@$V/go.mod $W/proxy/$M/@v/$V.mod
(cd $W/stage && zip -qrD $W/proxy/$M/@v/$V.zip $M@$V)
export GOMODCACHE=$W/modcache GOPROXY=file://$W/proxy GOSUMDB=off GOTOOLCHAIN=local
cd $W/c
printf 'module example.com/consumer\n\ngo 1.21\n\nrequire %s %s\n' $M $V > go.mod
printf 'package main\n\nimport (\n\t"fmt"\n\t"%s"\n)\n\nfunc main() { fmt.Println("OUT:", upstream.Greeting()) }\n' $M > main.go
go mod download $M@$V && go mod tidy            # go.sum: 2 lines
gsha(){ python3 -c "import hashlib,sys;d=open(sys.argv[1],'rb').read();print(hashlib.sha256(b'blob %d\0'%len(d)+d).hexdigest())" "$1"; }
B=$(gsha $W/stage/$M@$V/lib.go); A=$(gsha $W/patched.go); cp $W/patched.go .socket/blobs/$A
cat > .socket/manifest.json <<J
{"patches":{"pkg:golang/$M@$V":{"uuid":"4d5e6f70-8192-4a1b-8c2d-0123456789ab","exportedAt":"t","files":{"lib.go":{"beforeHash":"$B","afterHash":"$A"}},"vulnerabilities":{},"description":"","license":"","tier":""}},"setup":{"manual":["golang"]}}
J
$SP apply                 # exit 0, replace written
go mod tidy               # supported per docs; go.sum is now empty
go build -o /dev/null .   # OK (PATCHED)
$SP rollback              # exit 0, "Rolled back packages: pkg:golang/example.com/[email protected]"
go build -o /dev/null .   # exit 1: main.go:5:2: missing go.sum entry for module providing package example.com/upstream

$SP remove pkg:golang/example.com/[email protected] instead of rollback gives the same result. Without the go mod tidy step, both pass (go.sum keeps its 2 lines).

Expected vs actual

  • Expected: CLI_CONTRACT.md "Rollback command contract (v5.0)" says a bare rollback "restores the SYSTEM to unpatched". docs/ecosystems.md "Go: directory replaces and go.sum" says the wiring "survives go mod tidy". So after apply → tidy → rollback, the project should build exactly as it did before apply. That means either restoring the module's h1: and /go.mod h1: lines (as the hosted leg does) or, at minimum, a warning plus a non-silent outcome telling the user to run go mod tidy.
  • Actual: go.mod's require is left with no go.sum lines. Rollback/remove exit 0 with warnings: [] (--json), and the next default go build fails.

Matrix (Linux; each cell run 2× on go 1.24.7, 1× on the others)

go apply → rollback (no tidy) apply → tidy → rollback apply → tidy → remove
1.22.12 pass fail fail
1.24.7 pass fail fail
1.26.8 pass fail fail
macOS / Windows untested (probe branches currently blocked) untested untested

Vendored mode (vendor --revert after tidy) is untested here: it needs the mock patch service. The same drop-without-go.sum path looks likely.

Tested on main 61cfb9b (CLI 4.0.0). There have been no Go code changes since 4.0.0, so this isn't a regression in the 4.x line.

Suspect code

  • crates/socket-patch-core/src/patch/redirect/golang_local.rs:316 (remove_go_redirect) only calls go_mod_edit::drop_replace_entry (crates/socket-patch-core/src/vendor/go_mod_edit.rs:193) and removes the copy. go.sum is never reconciled and no warning is raised. Compare the hosted-takeover warning at crates/socket-patch-core/src/vendor/golang.rs:364-377.
Ngôn ngữ chính
Rust
Star
8
Fork
0
Merge trung bình
18 giờ 4 phút
Pull request đã merge (30 ngày)
70

Chuẩn bị môi trường

Bắt đầu từ đâu

  1. Đọc hết issue, rồi đọc hướng dẫn đóng góp của dự án.
  2. Bình luận trên issue rằng bạn sẽ nhận — tránh hai người làm cùng một việc.
  3. Fork repository và làm thay đổi trên một nhánh.
  4. Mở pull request có tham chiếu số hiệu của issue.

Issue khác của SocketDev/socket-patch

Tất cả issue của SocketDev/socket-patch

Issue tương tự

Thêm issue về Rust

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.