GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — Adapt yarn classic sha1 pins to main's URL redaction and empty-range … · SocketDev/socket-patch@224bd92

File tree

Expand file treeCollapse file tree
Open diff view settings
Filter options
  • crates
    • socket-patch-cli/tests/scan
      • hosted_yarn_classic_sha1.rs
    • socket-patch-core/src
      • hosted
        • engine.rs
      • patch/redirect
        • mod.rs
Expand file treeCollapse file tree
Open diff view settings
Collapse file

‎crates/socket-patch-cli/tests/scan/hosted_yarn_classic_sha1.rs‎

Copy file name to clipboardExpand all lines: crates/socket-patch-cli/tests/scan/hosted_yarn_classic_sha1.rs
+16-5Lines changed: 16 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -225,7 +225,7 @@ async fn issue_558_served_tarball_not_matching_the_grant_skips_the_patch() {
225225
write_classic_project(&root);
226226

227227
let (_, doc, stderr) = scan(&root, &server.uri());
228-
assert_skipped_untouched(&root, &server, &doc, &stderr);
228+
assert_skipped_untouched(&root, &doc, &stderr);
229229
}
230230

231231
#[tokio::test]
@@ -238,10 +238,18 @@ async fn issue_558_unfetchable_tarball_skips_the_patch() {
238238
write_classic_project(&root);
239239

240240
let (_, doc, stderr) = scan(&root, &server.uri());
241-
assert_skipped_untouched(&root, &server, &doc, &stderr);
241+
let detail = assert_skipped_untouched(&root, &doc, &stderr);
242+
// The detail still says where the fetch went, with the token redacted.
243+
assert!(
244+
detail.contains(&format!(
245+
"cannot fetch the hosted tarball: artifact not found: {}/patch/npm/left-pad/1.3.0/<redacted>/{UUID}/left-pad-1.3.0.tgz",
246+
server.uri()
247+
)),
248+
"{detail}"
249+
);
242250
}
243251

244-
fn assert_skipped_untouched(root: &Path, server: &MockServer, doc: &Value, stderr: &str) {
252+
fn assert_skipped_untouched(root: &Path, doc: &Value, stderr: &str) -> String {
245253
let skipped: Vec<&Value> = doc["redirect"]["skipped"]
246254
.as_array()
247255
.unwrap_or_else(|| panic!("redirect.skipped: {doc:#}\n{stderr}"))
@@ -250,17 +258,20 @@ fn assert_skipped_untouched(root: &Path, server: &MockServer, doc: &Value, stder
250258
.collect();
251259
assert_eq!(skipped.len(), 1, "{doc:#}");
252260
assert_eq!(skipped[0]["purl"], PURL, "{doc:#}");
261+
// The served URL's grant token authorizes the org's download: never
262+
// shown, whatever the detail says.
253263
let detail = skipped[0]["detail"].as_str().unwrap();
254264
assert!(
255-
!detail.contains(&server.uri()),
256-
"the hosted URL is redacted: {detail}"
265+
!detail.contains(TOKEN),
266+
"the grant token is redacted: {detail}"
257267
);
258268
assert_eq!(doc["redirect"]["redirected"], 0, "{doc:#}");
259269
assert_eq!(
260270
std::fs::read_to_string(root.join("yarn.lock")).unwrap(),
261271
LOCK,
262272
"no fragmentless hosted pin is written"
263273
);
274+
detail.to_string()
264275
}
265276

266277
/// #591: the served tarball's package.json adds a dependency yarn.lock
Collapse file

‎crates/socket-patch-core/src/hosted/engine.rs‎

Copy file name to clipboardExpand all lines: crates/socket-patch-core/src/hosted/engine.rs
+7-3Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1210,8 +1210,8 @@ pub fn record_classic_artifact(
12101210

12111211
/// The skip recorded for an npm dep whose served tarball could not be
12121212
/// fetched, did not match its grant's sha512 or had no readable
1213-
/// package.json, so its yarn classic pin could not be checked (the grant
1214-
/// token in `detail` is redacted to `<hosted artifact>`).
1213+
/// package.json, so its yarn classic pin could not be checked (`detail`
1214+
/// redacted by [`redact_artifact_text`]).
12151215
pub fn npm_tarball_unavailable(dep: &DepOverride, detail: &str) -> SkippedPatch {
12161216
SkippedPatch {
12171217
purl: format!(
@@ -1221,7 +1221,11 @@ pub fn npm_tarball_unavailable(dep: &DepOverride, detail: &str) -> SkippedPatch
12211221
),
12221222
uuid: dep.patch_uuid.clone(),
12231223
reason: "npm_tarball_unavailable".to_string(),
1224-
detail: Some(detail.replace(&dep.artifact_url, "<hosted artifact>")),
1224+
detail: Some(redact_artifact_text(
1225+
detail,
1226+
&dep.artifact_url,
1227+
&dep.patch_uuid,
1228+
)),
12251229
}
12261230
}
12271231

Collapse file

‎crates/socket-patch-core/src/patch/redirect/mod.rs‎

Copy file name to clipboardExpand all lines: crates/socket-patch-core/src/patch/redirect/mod.rs
+1-1Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10819,7 +10819,7 @@ mod tests {
1081910819
.unwrap_or_else(|| panic!("{key}: the block must be pinned: {:?}", r.warnings));
1082010820
assert!(out.contains(&format!("\n{key}\n")), "{key}: {out}");
1082110821
assert!(
10822-
out.contains("resolved \"http://p.test/lp.tgz\"")
10822+
out.contains("resolved \"http://p.test/lp.tgz#5ha1\"")
1082310823
&& out.contains("integrity sha512-PATCHED=="),
1082410824
"{key}: {out}"
1082510825
);

0 commit comments

Comments
0 (0)
You are visitor 01402520 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.