Hosted pnpm rollback drops the upstream `tarball:` URL from locks written with `lockfileIncludeTarballUrl`, so the restore isn't byte-exact
維護者通常 1 天內回覆
還沒有人認領這個 Issue。
評估
研究方向
Start at crates/socket-patch-core/src/formats/pnpm/grammar.rs:203, especially Resolution::restore, and review the pnpm compatibility property in docs/testing/pnpm-compatibility.md. Reproduce the hosted pin and rollback with lockfileIncludeTarballUrl enabled, then verify rollback restores the tarball URL when it was present and preserves its absence otherwise, with byte-exact lockfile output.
由索引模型根據 Issue 內容生成。
描述
[agent] Found by the scheduled pnpm bug-hunt routine (ledger #303).
Summary
With pnpm's lockfile-include-tarball-url=true (.npmrc) or lockfileIncludeTarballUrl: true (pnpm-workspace.yaml), pnpm records every resolution as {integrity: …, tarball: https://registry.npmjs.org/<name>/-/<name>-<ver>.tgz}. The hosted pin itself works: integrity and tarball are both replaced, and a fresh frozen install is patched. But rollback restores only {integrity: …}, so the lock no longer matches what pnpm wrote and the project setting asks for. pnpm doesn't re-add the field: a plain pnpm install afterwards leaves the lock unchanged ("up to date"), so the tarball URL stays lost until someone re-resolves.
Impact
Low. Installs still work, because pnpm derives the URL from the configured registry. But rollback isn't byte-exact, which docs/testing/pnpm-compatibility.md lists as a covered property. It also gives a spurious lock diff in projects that rely on recorded tarball URLs (mirrors, air-gapped tooling, audits).
Repro (Linux; local patch-API mock with SOCKET_PATCH_SERVER_URL / SOCKET_NPM_REGISTRY pointed at it)
mkdir app && cd app
echo '{"name":"app","version":"1.0.0","dependencies":{"is-number":"7.0.0"}}' > package.json
echo lockfile-include-tarball-url=true > .npmrc # pnpm 12: lockfileIncludeTarballUrl: true in pnpm-workspace.yaml
pnpm install && cp pnpm-lock.yaml before.yaml
socket-patch scan --mode hosted --json --yes … # success, redirected 1
socket-patch rollback --json --yes # success
diff before.yaml pnpm-lock.yaml
# - resolution: {integrity: sha512-41Cifkg6…, tarball: https://registry.npmjs.org/is-number/-/is-number-7.0.0.tgz}
# + resolution: {integrity: sha512-41Cifkg6…}
pnpm install && diff before.yaml pnpm-lock.yaml # still differs; pnpm doesn't re-add it
Expected vs actual
- Expected: CLI_CONTRACT ("Unwinding hosted state", npm family) says rollback restores the "resolution + integrity … from the npm registry's version document", and that document carries
dist.tarball. When the pre-pin entry had atarball:field (or the project setslockfileIncludeTarballUrl), rollback should write the registrydist.tarballback. When it didn't, rollback should keep omitting it. - Actual:
tarballis always omitted.
Matrix (Linux, each run twice)
| pnpm | hosted pin + fresh frozen install | rollback byte-exact |
|---|---|---|
9.15.9 (.npmrc) |
pass | fail |
10.34.5 (.npmrc) |
pass | not run |
| 12.8.1 (workspace setting) | pass | fail |
Suspect code
crates/socket-patch-core/src/formats/pnpm/grammar.rs:203 – Resolution::restore drops tarball unconditionally ("pnpm omits tarball for a package the configured registry serves"), which isn't true under this setting.
Tested on main 61cfb9b (CLI 4.0.0).
- 主要語言
- Rust
- 星號
- 8
- 分支
- 0
- 平均合併
- 1 天 31 分鐘
- 30 天內合併 PR
- 151
環境準備
- 沒有 Dockerfile 或 Docker Compose 檔案
- 沒有 Pull Request 範本
- 閱讀貢獻指南
從這裡開始
- 先讀完整個 Issue，再讀專案的貢獻指南。
- 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
- Fork 儲存庫，在一個分支上完成修改。
- 送出 Pull Request，並在描述裡引用這個 Issue 編號。
SocketDev/socket-patch 的其他 Issue
-
agent:triaged bug bughunt pm:yarn-berry priority:p1
難度 2/5 1-3 小時 新手友好度 73/100
SocketDev/socket-patch#783 · 1 則留言 ·
維護者通常 1 天內回覆
-
agent:triaged bug bughunt pm:pipenv priority:p1
難度 2/5 1-3 小時 新手友好度 83/100
SocketDev/socket-patch#744 · 1 則留言 ·
維護者通常 1 天內回覆
-
agent:triaged bug bughunt pm:cargo priority:p2
難度 2/5 1-3 小時 新手友好度 84/100
SocketDev/socket-patch#651 · 3 則留言 ·
維護者通常 1 天內回覆
-
agent:triaged bug bughunt pm:composer priority:p2
難度 2/5 1-3 小時 新手友好度 90/100
SocketDev/socket-patch#515 · 1 則留言 ·
維護者通常 1 天內回覆
-
A report-only `scan -g` tells you to run `socket-patch scan --mode agent [PATHS]` without `-g`, so following the hint scans the cwd project instead of the global install可能已有人在做 關聯的 PR 仍在進行中或已合併。 未關閉agent:triaged bug bughunt pm:npm priority:p1
難度 2/5 1-3 小時 新手友好度 82/100
SocketDev/socket-patch#464 · 1 則留言 ·
維護者通常 1 天內回覆
查看 SocketDev/socket-patch 的全部 Issue
相似的 Issue
-
review-drift
難度 2/5 1-3 小時 新手友好度 78/100
oxidecomputer/hansei#14 ·
-
難度 2/5 1-3 小時 新手友好度 76/100
rubys/roundhouse#444 ·
維護者通常 1 天內回覆
-
難度 2/5 1-3 小時 新手友好度 85/100
維護者通常 1 天內回覆
-
難度 2/5 1-3 小時 新手友好度 78/100
維護者通常 1 天內回覆
-
install: root SSH tmpfiles.d drop-in is labeled etc_runtime_t instead of etc_t可能已有人在做 @andrewdunndev 今天認領。 未關閉
難度 2/5 1-3 小時 新手友好度 82/100
維護者通常 1 天內回覆