Hacktoberfest 2026：維護者為十月標記出來的 issue，仍然開放、適合新手。 瀏覽 Hacktoberfest issue

Go rollback and remove in a go.work member stay silent about a stale `go work vendor` modules.txt, so every workspace build fails with "inconsistent vendoring"

未關閉
  • 哪裡不對？
#1,766 3 則留言 0 個 reaction 已指派 0 人 在 GitHub 檢視

維護者通常 1 天內回覆

@mikolalysenko 已經在處理了。

開始於 2026年10月28日。

  • #1767 來自 @mikolalysenko —— 未關閉

評估

難度
4/5
預估耗時
3-5 天
新手友好度
15/100
Issue 類型
缺陷
描述清晰度
基本清楚
活躍度
停滯
技術堆疊
go, rust
領域
build-system, cli

研究方向

Start in crates/socket-patch-core/src/vendor/go_consumer_sync.rs, where vendor_modules_txt_issues filters recorded replacements by socket_owned() around line 580, and compare with same_replacement, which already strips the member prefix for workspaces. Reproduce with the e2e_golang_build shape in tests/e2e_golang_build.rs using a use ./a member, then run rollback. Done means that warning fires and the workspace builds. Open PR #1767 already targets this, so coordinate with it first.

由索引模型根據 Issue 內容生成。

描述

agent:claimed agent:triaged bug bughunt pm:go priority:p2

[agent] Found by the scheduled Go modules bug-hunt routine (ledger #317).

Summary

The #343 fix (#1357) warns go_vendor_modules_txt_out_of_sync when a committed vendor directory still records a socket-patch replacement that go.mod no longer has. In a workspace, this only works when the patched module is the go.work root (use .). For any other member (use ./a), go work vendor records the member's replace relative to the workspace root:

# example.com/upstream v1.0.0 => ./a/.socket/go-patches/example.com/[email protected]

detect_owner (crates/socket-patch-core/src/vendor/go_mod_edit.rs:88) only treats a target as socket-owned when it starts with ./.socket/go-patches/ or ./.socket/vendor/golang/. So this recorded line counts as user-authored, and the stale check in vendor_modules_txt_issues (crates/socket-patch-core/src/vendor/go_consumer_sync.rs:580, recorded.iter().filter(|r| r.socket_owned())) skips it.

The other direction already works: after apply, the "not recorded" warning fires, because same_replacement does a suffix match for workspaces.

Impact

After rollback or remove in a non-root member of a vendored workspace, both commands exit 0 with no warning, and apply --check says "No patches to check" (exit 0). But every workspace build (go build, go run, go test, which default to -mod=vendor when the workspace has vendor/modules.txt) now fails:

go: inconsistent vendoring in …/ws:
	example.com/[email protected]: is marked as replaced in vendor/modules.txt, but not replaced in the workspace

The same rollback in a use . root module does warn, which is the documented behaviour.

Repro

Hermetic file GOPROXY, hand-staged .socket/manifest.json plus blob (the tests/e2e_golang_build.rs shape). Go 1.22+ (go work vendor).

# ws/go.work:  go 1.22 \n use ./a
# ws/a/go.mod: module example.com/a; require example.com/upstream v1.0.0; main.go prints upstream.Greeting()
# ws/a/.socket/manifest.json + blob patching lib.go PRISTINE -> PATCHED
cd ws && go work vendor
(cd a && socket-patch apply)        # warns go_vendor_modules_txt_out_of_sync (correct)
go work vendor && go run ./a        # OUT: PATCHED
cd a && socket-patch rollback --json   # status success, warnings: none   <-- bug
socket-patch apply --check; echo $?    # "No patches to check.", 0
cd .. && go run ./a                 # go: inconsistent vendoring … is marked as replaced in vendor/modules.txt, but not replaced in the workspace

socket-patch remove pkg:golang/example.com/[email protected] behaves the same way. Control: the same steps with use . and the module at the workspace root make rollback warn go_vendor_modules_txt_out_of_sync.

Expected vs actual

  • Expected, per docs/ecosystems.md (warning table, go_vendor_modules_txt_out_of_sync): the warning fires for "a committed vendor/ directory (go mod vendor; go work vendor for a workspace) whose vendor/modules.txt … still records one that was removed", with the fix go work vendor.
  • Actual: no warning from rollback or remove when the project is a non-root use member. Exit 0, and the workspace no longer builds.

Matrix (Linux)

go use ./a member: rollback/remove warn use . root: rollback warns
1.22.12 fail (silent, build broken) —
1.24.7 fail (3×, rollback and remove) pass
1.26.8 fail —
< 1.22 n/a (no go work vendor) n/a

macOS and Windows: untested (probe branches are blocked in this routine). Vendored mode (.socket/vendor/golang/) goes through the same detect_owner prefix check, so it is likely affected, but I didn't test it (it needs a mock patch service).

The open PR stack #1764/#1765 does not fix it: I built #1765's head (pr1765). There a single-member patch still goes into a/go.mod, and the same repro gives rollback warnings: [] and then "inconsistent vendoring".

Suspect code

  • crates/socket-patch-core/src/vendor/go_consumer_sync.rs:580: the stale loop filters recorded by socket_owned(). In workspace mode, ownership needs to be judged after stripping the member's directory prefix, relative to the go.work directory (as same_replacement already does for the forward check).
  • crates/socket-patch-core/src/vendor/go_mod_edit.rs:88: detect_owner is root-anchored by design (a user's ../sibling/.socket/… replace must stay user-owned), so the fix belongs in the workspace audit, not in detect_owner.

Tested on main b787454 (5.0.1+171).

主要語言
Rust
星號
8
分支
2
平均合併
19 小時 53 分鐘
30 天內合併 PR
667

環境準備

  • 沒有 Dockerfile 或 Docker Compose 檔案
  • 沒有 Pull Request 範本
  • 閱讀貢獻指南

從這裡開始

  1. 先讀完整個 Issue，再讀專案的貢獻指南。
  2. 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
  3. Fork 儲存庫，在一個分支上完成修改。
  4. 送出 Pull Request，並在描述裡引用這個 Issue 編號。

SocketDev/socket-patch 的其他 Issue

查看 SocketDev/socket-patch 的全部 Issue

相似的 Issue

更多 Rust Issue

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。