Hosted vlt scan tells users to try --mode vendored for a named-registry package, but vendored always refuses that package with vendor_lock_entry_unsupported
維護者通常 1 天內回覆
還沒有人認領這個 Issue。
評估
研究方向
誤導性提示是 crates/socket-patch-core/src/patch/redirect/vlt.rs 中 rewrite_dep 內、約第 366-371 行的詳細文字 redirect_vlt_custom_registry_skipped。與之矛盾的 vendored 拒絕位於 crates/socket-patch-core/src/vendor/vlt_lock.rs:2429。閱讀兩者，然後決定該提示應只提及 agent 模式，還是說明 vendored 拒絕該套件。完成的標準是：對於使用非預設註冊表的實例，警告不再建議使用 vendored，並且在建構警告的位置更新了措辭。
由索引模型根據 Issue 內容生成。
描述
[agent] Found by the scheduled vlt bug-hunt routine (ledger #307).
Summary
A vlt project can install a dependency from a named registry ("left-pad": "acme:[email protected]" with vlt.json registries.acme, DepID [email protected]). A hosted scan skips that package, as documented, with the warning redirect_vlt_custom_registry_skipped, which ends with "(use --mode vendored or agent mode)". Vendored mode then refuses the same package every time: vendor_lock_entry_unsupported, "…not from vlt's default registry; vendoring rewires only default-registry packages". The run exits 1 with partialFailure. Only agent mode works. In my runs it patched the copy and rolled it back cleanly.
Impact
Low severity, but the run sends the user down the wrong path. The remediation hint names a mode that can't succeed. A user (or a CI script that follows the hint) switches to vendored, gets a failed run, and still has the package unpatched. Nothing is written incorrectly: hosted leaves the node alone, and vendored refuses without writing.
Repro (vlt 1.4.0 or 1.3.8, main 657fce2; the string is identical in release 5.0.1)
Use the mock registry / patch API attached to #1494, started three times: PORT=18555, PORT=18556 (patch API) and PORT=18557 (the "acme" registry). Use the env from #1494.
mkdir proj && cd proj
echo '{"name":"root","version":"1.0.0","dependencies":{"left-pad":"acme:[email protected]","right-pad":"1.3.0"}}' > package.json
echo '{"config":{"registries":{"npm":"http://127.0.0.1:18555/","acme":"http://127.0.0.1:18557/"}}}' > vlt.json
vlt install --allow-scripts :scripts
socket-patch scan --mode hosted --yes --json
# exit 0; left-pad: skipped redirect_unconfirmed
# warning redirect_vlt_custom_registry_skipped: "... [email protected] left unchanged (use --mode vendored or agent mode)"
socket-patch rollback --yes
socket-patch scan --mode vendored --yes --json
# exit 1, partialFailure; left-pad: failed vendor_lock_entry_unsupported
# "vlt-lock.json resolves [email protected] as [email protected], which is not from vlt's default registry; vendoring rewires only default-registry packages"
Agent mode control: scan --mode agent exits 0 and require('left-pad') prints patched; rollback restores pristine.
Expected vs actual
- Expected: the hint names only modes that can patch the package.
docs/ecosystems.md(vlt, "Hosted: the slot rewrite") says such instances stay untouched (redirect_vlt_custom_registry_skipped). The vendored vlt path refuses any non-default-registry instance (vendor/vlt_lock.rs:2429), so the hint should point to agent mode only, or say vendored also refuses it. - Actual: "use --mode vendored or agent mode".
OS × version
| OS | vlt | hosted hint | vendored | agent |
|---|---|---|---|---|
| Linux | 1.4.0 | names vendored (2/2) | refused (2/2) | pass |
| Linux | 1.3.8 | names vendored | refused | (not run) |
macOS / Windows: not probed. The message is platform-independent.
The code is the same in release 5.0.1, so this isn't a regression in the current release line. I didn't bisect further.
Suspect code
crates/socket-patch-core/src/patch/redirect/vlt.rs:366-371(rewrite_dep): theredirect_vlt_custom_registry_skippeddetail text.crates/socket-patch-core/src/vendor/vlt_lock.rs:2429: the vendored refusal that the hint contradicts.
- 主要語言
- Rust
- 星號
- 8
- 分支
- 1
- 平均合併
- 16 小時 18 分鐘
- 30 天內合併 PR
- 587
環境準備
- 沒有 Dockerfile 或 Docker Compose 檔案
- 沒有 Pull Request 範本
- 閱讀貢獻指南
從這裡開始
- 先讀完整個 Issue，再讀專案的貢獻指南。
- 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
- Fork 儲存庫，在一個分支上完成修改。
- 送出 Pull Request，並在描述裡引用這個 Issue 編號。
SocketDev/socket-patch 的其他 Issue
-
agent:triaged bug bughunt pm:pipenv priority:p1
難度 2/5 1-3 小時 新手友好度 78/100
SocketDev/socket-patch#1608 · 1 則留言 ·
維護者通常 1 天內回覆
-
agent:triaged bug bughunt pm:npm priority:p3 ux
難度 2/5 1-3 小時 新手友好度 75/100
SocketDev/socket-patch#1072 · 2 則留言 ·
維護者通常 1 天內回覆
-
agent:triaged bug bughunt pm:yarn-berry priority:p1
難度 2/5 1-3 小時 新手友好度 73/100
SocketDev/socket-patch#783 · 1 則留言 ·
維護者通常 1 天內回覆
-
Vendored cargo warns cargo_multi_version_old_cargo ("declares no rust-version") when the root package inherits rust-version from [workspace.package]可能已有人在做 @mikolalysenko 於 4 天前認領。 未關閉agent:triaged bug bughunt pm:cargo priority:p2
難度 2/5 1-3 小時 新手友好度 84/100
SocketDev/socket-patch#651 · 3 則留言 ·
維護者通常 1 天內回覆
-
agent:triaged bench enhancement perf-regression pm:bun priority:p1
難度 5/5 一週以上 新手友好度 8/100
SocketDev/socket-patch#1606 · 1 則留言 ·
維護者通常 1 天內回覆
查看 SocketDev/socket-patch 的全部 Issue
相似的 Issue
-
bug
難度 2/5 1-3 小時 新手友好度 66/100
shep-pm/shep-kelpie#980 ·
維護者通常 1 天內回覆
-
bug frontend rt sev-3
難度 2/5 1-3 小時 新手友好度 72/100
-
C-bug
難度 1/5 1 小時以內 新手友好度 88/100
-
[1.x Bug] run-operation --sql reports success but rolls back writes on transaction-capable adapters未關閉triage
難度 2/5 1-3 小時 新手友好度 64/100
維護者通常 1 天內回覆
-
area:cli bug good first issue priority:medium
難度 2/5 1-3 小時 新手友好度 74/100
維護者通常 1 天內回覆