`get <uuid>` overrides socket.yml without the documented `policy_bypassed` warning (purl/CVE/GHSA forms do warn)
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
调研方向
Start in crates/socket-patch-cli/src/commands/get.rs:2603-2700, tracing the IdentifierType::Uuid mode branches and compare them with the search path reaching policy_bypass_warnings at lines 2929-2933. Reproduce the hosted, vendored, and agent commands from the issue with socket.yml excluding the package. Done means UUID get reports policy_bypassed in warnings[] and on stderr whenever policy would skip the package.
由索引模型根据 Issue 内容生成。
描述
[agent] Found by the scheduled Pipenv bug-hunt routine (ledger #313).
Summary
The contract says get ignores socket.yml but has to say so when it does. When the repo's socket.yml would have skipped the package, get must warn policy_bypassed, both in warnings[] and on stderr. The purl, CVE and GHSA forms of get do this. The UUID form doesn't. get <uuid> takes an early-return path straight into the mode dispatch, and that path never calls policy_bypass_warnings. The package gets patched in every mode (agent, hosted, vendored) with exit 0, no stderr line, and no warnings key in the --json envelope.
I found this on a Pipenv project, but the code path doesn't depend on the ecosystem.
Impact
policy_bypassed is the only signal that a run overrode the repository's rollout policy (ignorePackages, ecosystems, includePaths/ignorePaths, minSeverity, enabled: false). A UUID is the identifier that dashboards, bots and the scan table all hand out. So the most common scripted get can push a patch the repo explicitly excluded (for example enabled: false during a freeze) and leave nothing in CI logs or JSON output to flag it.
Repro (Linux, main 2463257, Pipenv 2026.8.0 project, local mock patch API)
git init -q proj && cd proj
# Pipfile + Pipfile.lock pinning six==1.16.0 (pipfile-spec 6)
printf 'version: 2\npatches:\n ignorePackages: ["pkg:pypi/six"]\n' > socket.yml
socket-patch get pkg:pypi/[email protected] --mode hosted --yes --json | jq .warnings
# ["(policy_bypassed) pkg:pypi/[email protected] would be skipped by socket.yml (policy_package_ignored: pkg:pypi/six (patches.ignorePackages)); get patches it anyway"]
git checkout Pipfile.lock 2>/dev/null || cp Pipfile.lock.orig Pipfile.lock
socket-patch get <uuid-of-that-patch> --mode hosted --yes --json | jq .warnings
# null (Pipfile.lock is rewritten, exit 0, nothing on stderr)
Results from two runs, each identical:
| Command | exit | lock patched | warnings[] policy_bypassed |
stderr warning |
|---|---|---|---|---|
get pkg:pypi/[email protected] --mode hosted |
0 | yes | yes | yes |
get pkg:pypi/[email protected] --mode vendored |
0 | yes | yes | yes |
get <uuid> --mode hosted |
0 | yes | missing | missing |
get <uuid> --mode vendored |
0 | yes | missing | missing |
get <uuid> --mode agent |
0 | n/a (in place) | missing | missing |
Expected vs actual
- Expected:
crates/socket-patch-cli/CLI_CONTRACT.md(socket.yml, "Commands") says: "getis explicit intent: it ignores the policy and warnspolicy_bypassed(inwarnings[], and on stderr) when socket.yml would have skipped the package".docs/configuration.mdsays the same: "it bypasses policy and warns when a valid policy would exclude its target". Neither carves out the UUID form. - Actual: only the search-backed forms warn. The UUID form patches silently.
OS × version
| OS | Pipenv | reproduces |
|---|---|---|
| Linux | 2026.8.0 (SOCKET_PIPENV_MAJOR=2026) |
yes (2/2) |
| macOS / Windows | — | not probed. The code path is platform-independent. |
First bad
socket.yml arrived with #277 (2463257) and isn't in any published release (v4.0.0 predates it). So the bug has been there since the feature landed.
Suspect code
crates/socket-patch-cli/src/commands/get.rs:2603-2700: theIdentifierType::Uuidbranch returns from thematch modedispatch (save_and_apply_patch/run_get_hosted(…, &[], &[])/run_get_vendored(…, &[], &[])) with empty warning lists.crates/socket-patch-cli/src/commands/get.rs:2929-2933: the only call site ofsuper::scan::policy::policy_bypass_warnings, which only the search path reaches.
- 主要语言
- Rust
- 星标
- 8
- 派生
- 0
- 平均合并
- 1 天 7 分钟
- 30 天内合并 PR
- 178
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 没有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
SocketDev/socket-patch 的其他 Issue
-
Hosted yarn classic pins give no berry-migration warning, so a yarn 2+ install silently drops them (vendored warns about the same trap)可能已有人在做 @mikolalysenko 今天认领。 未关闭agent:claimed agent:triaged bug bughunt pm:yarn-classic priority:p1
难度 2/5 1-3 小时 新手友好度 85/100
SocketDev/socket-patch#907 · 2 条评论 ·
维护者通常 1 天内回复
-
agent:triaged bug bughunt pm:npm priority:p1
难度 2/5 1-3 小时 新手友好度 75/100
SocketDev/socket-patch#900 ·
维护者通常 1 天内回复
-
agent:triaged bug bughunt pm:bundler priority:p1
难度 2/5 1-3 小时 新手友好度 85/100
SocketDev/socket-patch#896 · 1 条评论 ·
维护者通常 1 天内回复
-
agent:triaged bug bughunt pm:yarn-berry priority:p1
难度 2/5 1-3 小时 新手友好度 73/100
SocketDev/socket-patch#783 · 1 条评论 ·
维护者通常 1 天内回复
-
agent:triaged bug bughunt pm:pipenv priority:p1
难度 2/5 1-3 小时 新手友好度 83/100
SocketDev/socket-patch#744 · 1 条评论 ·
维护者通常 1 天内回复
查看 SocketDev/socket-patch 的全部 Issue
相似的 Issue
-
难度 1/5 1 小时以内 新手友好度 80/100
Devolutions/picky-rs#546 · 1 条评论 ·
维护者通常 3 天内回复
-
难度 2/5 1-3 小时 新手友好度 76/100
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 74/100
维护者通常 1 天内回复
-
enhancement
难度 2/5 1-3 小时 新手友好度 78/100
zcashlabs/thus-spoke-zakura#153 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 79/100
topgrade-rs/topgrade#2395 ·
维护者通常 1 天内回复