Hosted gem `rollback` / `remove` still strip the DEPENDENCIES `!` when the user's `source … do` block holds an assignment-form `v = if/case/begin … end`, so frozen installs fail on Bundler 4.0.19+
维护者通常 1 天内回复
评估
调研方向
Read crates/socket-patch-core/src/patch/redirect/upstream/gem.rs, starting with opens_keyword_block, in_source_block, and restore_one; the issue traces how an assignment-form keyword construct can pop the source block frame. Use the reproduction based on crates/socket-patch-cli/tests/e2e_redirect_gem_build.rs and the supplied Bundler 4.0.22 command to check rollback and remove. Done means the restored lock retains the !, the Gemfile is byte-identical, and a frozen install succeeds; linked PR #1478 is already open.
由索引模型根据 Issue 内容生成。
描述
[agent] Found by the scheduled Bundler (RubyGems) bug-hunt routine (ledger #316).
Summary
#1056 is closed (fixed by #1303), but one shape still breaks. If the user's source "…" do block contains an assignment-form keyword construct (v = if …, v = case …, v = begin …) before the patched gem, hosted rollback and remove still restore DEPENDENCIES as vuln-gem (= 1.0.0) without the !. Bundler pins a gem declared in a source block with !, so the restored lock no longer matches the Gemfile. On Bundler 4.0.19 and later, every frozen or deployment install then fails with exit 16. The unwind reports success (exit 0).
The previous bug-hunt run posted this as a comment on the closed #1056, where it is easy to miss. This issue tracks it on its own.
Impact
After socket-patch rollback or remove, CI and deploy checkouts that use BUNDLE_FROZEN / BUNDLE_DEPLOYMENT fail with "Your lockfile needs to be updated, but it can't be because frozen mode is set". The restored Gemfile also comes back dedented (gem "vuln-gem", "1.0.0" at column 0, after a blank line, inside the block), so it isn't byte-identical either.
Repro
I used a scratch copy of crates/socket-patch-cli/tests/e2e_redirect_gem_build.rs and changed only the Driver::ScanVexSourceBlock Gemfile to:
source "<up>/upstream"
source "<up>/upstream" do
v = if ENV["ZZ"]
"a"
else
"b"
end
gem "vuln-gem", "1.0.0"
end
Then I ran:
gem install bundler -v 4.0.22
BUNDLER_VERSION=4.0.22 SOCKET_PATCH_BUNDLER_E2E_VERSION=4.0.22 SOCKET_PATCH_BUNDLER_E2E_REQUIRED=1 \
cargo test -p socket-patch-cli --test <scratch copy> -- gem_hosted_unwind_keeps_a_source_block_bang --include-ignored --nocapture
Result: rollback exits 0, but the lock differs from the pristine lock only in the missing !:
- vuln-gem (= 1.0.0)!
+ vuln-gem (= 1.0.0)
The fresh-checkout BUNDLE_FROZEN=true bundle install then fails:
Your lockfile needs to be updated, but it can't be because frozen mode is set.
The same Gemfile without the v = if … end lines passes, which is what the existing test covers.
I also confirmed Bundler's side on its own, with no socket-patch involved. I took a real rubygems.org project (colorize 0.8.1 in the same block shape) and deleted only the !. On Bundler 4.0.22 the frozen install then exits 16, both with and without a CHECKSUMS section, and passes with the !. On 4.0.18 it only warns ("Cannot write a changed lockfile while frozen.") and exits 0.
Expected vs actual
- Expected: CLI_CONTRACT.md / docs/ecosystems.md ("Hosted unwind") say the restore re-derives the upstream lock, and #1056's fix made the
!survive for gems declared in a user source block. The lock should come back byte-identical (!included), and a frozen install of the restored pair should pass. - Actual: the
!is dropped and the frozen install fails.
Matrix (Linux, Ruby 3.3.6, main 15c2c83)
| Bundler | Shape | Lock byte-identical after rollback |
Frozen install of the restored pair |
|---|---|---|---|
| 4.0.22 | v = if … end |
no (×2) | fails, exit 16 (×2) |
| 4.0.18 | v = if … end |
no (×3) | passes with a "Cannot write a changed lockfile" warning |
| 4.0.18 / 2.6.9 | v = case … end (run 38, main 6ad6add) |
no | — |
| any | plain block, CRLF block (#1056 fix) | yes | passes |
macOS and Windows weren't probed. The logic is text-only and OS-independent.
Suspect code
crates/socket-patch-core/src/patch/redirect/upstream/gem.rs:586 (opens_keyword_block) only counts if/unless/case/begin/… as block openers when the keyword is the first token of the line. In v = if ENV["ZZ"], the first token is v, so no frame is pushed, but the matching end still pops one. That pop removes the user's source frame in in_source_block (gem.rs:541), and restore_one falls through to DepEntry::Unpin (gem.rs:899). The same problem probably applies to x = while …, x = until … and x = unless …, and to the dedent of the restored declaration.
- 主要语言
- Rust
- 星标
- 8
- 派生
- 1
- 平均合并
- 16 小时 35 分钟
- 30 天内合并 PR
- 574
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 没有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
SocketDev/socket-patch 的其他 Issue
-
agent:triaged bug bughunt pm:bundler priority:p1
难度 2/5 1-3 小时 新手友好度 70/100
SocketDev/socket-patch#1573 · 1 条评论 ·
维护者通常 1 天内回复
-
agent:triaged bug bughunt pm:poetry priority:p1
难度 2/5 1-3 小时 新手友好度 80/100
SocketDev/socket-patch#1547 · 1 条评论 ·
维护者通常 1 天内回复
-
agent:triaged bug bughunt pm:npm priority:p3 ux
难度 2/5 1-3 小时 新手友好度 75/100
SocketDev/socket-patch#1072 · 2 条评论 ·
维护者通常 1 天内回复
-
agent:triaged bug bughunt pm:yarn-berry priority:p1
难度 2/5 1-3 小时 新手友好度 73/100
SocketDev/socket-patch#783 · 1 条评论 ·
维护者通常 1 天内回复
-
Vendored cargo warns cargo_multi_version_old_cargo ("declares no rust-version") when the root package inherits rust-version from [workspace.package]可能已有人在做 @mikolalysenko 于 3 天前认领。 未关闭agent:triaged bug bughunt pm:cargo priority:p2
难度 2/5 1-3 小时 新手友好度 84/100
SocketDev/socket-patch#651 · 3 条评论 ·
维护者通常 1 天内回复
查看 SocketDev/socket-patch 的全部 Issue
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 62/100
bytecodealliance/rustix#1706 · 1 条评论 ·
维护者通常 11 天内回复
-
难度 2/5 1-3 小时 新手友好度 62/100
-
难度 2/5 1-3 小时 新手友好度 72/100
wormhole-foundation/wormhole#5062 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 82/100
维护者通常 1 天内回复
-
bug
难度 1/5 1 小时以内 新手友好度 88/100
wboayue/stable-flight#420 ·
维护者通常 1 天内回复