Hacktoberfest 2026：维护者为十月标记出来的 issue，仍然开放、适合新手。 浏览 Hacktoberfest issue

VEX product detection fails on Poetry 2 projects that declare dynamic = ["version"] with the version in [tool.poetry], so scan --vex exits 1 after rewriting poetry.lock

已关闭
  • 哪里不对？
#1,527 3 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

已经有一个关联 PR 被合并了。

  • #1529 来自 @mikolalysenko —— 已合并

评估

难度
3/5
预计耗时
半天
新手友好度
25/100
Issue 类型
缺陷
描述清晰度
描述清楚
活跃度
停滞
技术栈
python, rust
领域
cli

调研方向

Start in crates/socket-patch-core/src/vex/product.rs, at parse_pyproject and scan_toml_section, to see why name and version must come from one section. Reproduce with the layout in the issue, then run socket-patch vex -O v.json in a directory with no git origin. Done when that command yields pkg:pypi/[email protected] without --product. The test pattern is in crates/socket-patch-cli/tests/in_process_redirect_poetry.rs. Linked PR #1529 is already open against this bug.

由索引模型根据 Issue 内容生成。

描述

agent:claimed agent:triaged bug bughunt pm:poetry priority:p1

[agent] Found by the scheduled Poetry bug-hunt routine (ledger #311).

Summary

Poetry 2 documents a PEP 621 layout where [project] has name and dynamic = ["version"], and the version is in [tool.poetry] version (see https://python-poetry.org/docs/pyproject/#version). poetry check, poetry version and poetry build all accept it (demo 0.3.0, demo-0.3.0-py3-none-any.whl).

vex/product.rs::parse_pyproject reads name and version from one section only. It tries [project], which has no version, and then [tool.poetry], which has no name. Both return None, so no product is detected:

  • socket-patch vex -O out.json exits 2 with product_undetected ("pyproject.toml was found but has no usable name and version").
  • socket-patch scan --mode hosted --vex out.json exits 1 with product_undetected, after it has already rewritten poetry.lock to the hosted pin. No VEX document is written.

This happens whenever the product falls through to the manifest probe, which means a checkout with no git origin remote (for example a source tarball or an exported tree). A git remote takes priority in detect_product.

This isn't the same as #642. That issue is about a missing [tool.pdm] fallback. Here both sections are read, but their keys are never combined.

Impact

  • Any Poetry 2 project that uses the documented dynamic-version layout gets no VEX unless the user passes --product by hand, and scan --vex turns a successful hosted rewrite into a failed command (exit 1) in CI.
  • The lock rewrite is still committed, so a retry without --vex has nothing left to do, and the failure looks like a broken scan.

Repro (Linux, Poetry 2.0.1 / 2.2.1 / 2.5.1, no git checkout)

A local mock of the patch API serves a hosted patch for pkg:pypi/[email protected] (same routes as crates/socket-patch-cli/tests/in_process_redirect_poetry.rs). Any patched dependency would do.

mkdir demo-proj && cd demo-proj && mkdir demo && touch demo/__init__.py
cat > pyproject.toml <<'EOF'
[project]
name = "demo"
dynamic = ["version"]
requires-python = ">=3.9"
dependencies = ["six==1.16.0"]

[tool.poetry]
version = "0.3.0"

[build-system]
requires = ["poetry-core>=2.0.0"]
build-backend = "poetry.core.masonry.api"
EOF
poetry check          # All set!
poetry version        # demo 0.3.0
poetry lock
socket-patch scan --mode hosted --json --vex out.vex.json
#  exit 1, status "error", error.code "product_undetected"
#  poetry.lock now carries the hosted pin; out.vex.json not written
socket-patch vex -O v.json                               # exit 2, product_undetected
socket-patch vex -O v.json --product pkg:pypi/[email protected] # exit 0 (workaround)

Control: with version = "0.3.0" in [project] (no dynamic, no [tool.poetry]), scan --mode hosted --vex exits 0 and the product is pkg:pypi/[email protected].

Expected vs actual

  • Expected: vex --help documents auto-detection from "pyproject.toml: pkg:pypi/@". For a project Poetry itself builds as demo 0.3.0, the product should be pkg:pypi/[email protected]: [project].name, plus the [tool.poetry].version that Poetry uses when version is listed in [project].dynamic. CLI_CONTRACT.md ("Fail-the-command") says scan --vex exits non-zero when the product is undetectable, but here it can be detected.
  • Actual: product_undetected. vex exits 2, and scan --vex exits 1 after it has written the lock.

OS × version

OS Poetry Result
Linux 2.0.1 fail (2/2)
Linux 2.2.1 fail
Linux 2.5.1 fail (2/2)
Linux 2.5.1, static [project].version (control) pass
macOS / Windows any untested. The code path doesn't depend on the OS (pure TOML text scan).

Poetry 1.x ignores [project], so the layout only applies to Poetry ≥ 2.0.

Suspect code

  • crates/socket-patch-core/src/vex/product.rs:157-165 (parse_pyproject): scan_toml_section(content, "project").or_else(|| scan_toml_section(content, "tool.poetry")) needs both keys from the same section. When [project] has a name and dynamic contains "version", it should take the version from [tool.poetry].
  • crates/socket-patch-core/src/vex/product.rs:368 (scan_toml_section) returns nothing unless both keys are present.

Main 6a06ddd. No probe runs: probe branches are still blocked for this routine (see ledger #311).

主要语言
Rust
星标
8
派生
1
平均合并
16 小时 18 分钟
30 天内合并 PR
587

环境准备

  • 没有 Dockerfile 或 Docker Compose 文件
  • 没有 Pull Request 模板
  • 阅读贡献指南

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

SocketDev/socket-patch 的其他 Issue

查看 SocketDev/socket-patch 的全部 Issue

相似的 Issue

更多 Rust Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。