GeezerVisonThe World Wide Web, restored to 800 pixels of glory. | ||||||||||||||||||||||||||
| Home|About|Gaming cabinet|Archives|How it works|Starter sites | ||||||||||||||||||||||||||
GeezerVison is showing github.com — Fix requirements pin spellings not contesting VEX (#1602) by mikolalysenko · Pull Request #1632 · SocketDev/socket-patch Conversation
|
| Issue case | Test | Without fix | With fix |
|---|---|---|---|
#1602 ===X, ==X.0, ==vX, padded + marker (real CLI, Pipfile.lock wired) |
e2e_vex_lockfile pipenv::requirements_pin_spellings_contest_the_lock_wiring |
FAILED (vex exit 0, at vex_pipenv_pip_common/mod.rs:1385) |
ok |
#1602 every spelling (===, ==1.16.0.0, ==v1.16.0, ==1.16, case/marker/extras/hash) contests; ==1.16.1, ~=, ==1.16.*, ===1.16, other name don't |
socket-patch-core vex::discover::pypi_other::tests::issue_1602_requirements_pin_spellings_contest_wiring |
(new, same file as the fix) | ok |
| A tree that wires another spelling of the release isn't a contester | ...::issue_1602_a_tree_wiring_another_spelling_contests_nothing |
FAILED with the old exact-string wiring check | ok |
Commands run locally:
cargo fmt --all -- --check: cleancargo clippy --workspace --all-features -- -D warnings: cleancargo test -p socket-patch-core --all-features --lib -- vex::discover production_code_classifies_purls: 416 passed on 1b96ed7cargo test --workspace --all-features --no-fail-fast (on 65efed5): 232 test targets ok. The 10 failures are sandbox-only. Nine are read-only-permission / write-failure tests that can't fail when running as root (uid 0): copy_tree::relax_loop_must_not_traverse_symlinked_root ("removal cannot succeed under a read-only parent"), vlt_heal::an_unremovable_hidden_lock…, pypi_poetry::wire_write_failure…, pypi_requirements::wire_failure_rolls_back…, 3 in in_process_redirect, 2 in repair. The tenth, e2e_bun_lockb::binary_shared_bundled_record_hosted_pin_is_managed, failed because the sandbox proxy blocked patches-api.socket.dev. The one real failure, the purl-type lint, is fixed in 1b96ed7.Fixed: the wiring exclusion compared strings exactly; === was read under PEP 440; duplicate helper; the hard-coded version in the e2e case; the stale exact_pin comment.
Not fixed, with reasons:
==X pin also matches X+local under PEP 440. That gap already existed before this PR (a canonical ==2.1.0 never contested a wired 2.1.0+cpu). Lock entries resolve exact versions, so folding local labels into covers would be wrong for them. It needs a requirements-only rule, which is a separate follow-up.PurlKey. PurlKey keys maps across every ecosystem, and PyPI is kept spelling-exact there on purpose (pypi_equivalent_purls exists for this). Changing it would touch much more than this fix needs.=== line, so the contest persists. That's correct: pip installs upstream for that line, so the attestation must stay withheld until the user changes it. === now matches only its exact string.https://claude.ai/code/session_01FuB4p2UQANHrpx4dHRwddS
Generated by Claude Code
Sorry, something went wrong.
There was an error while loading. Please reload this page.
Assisted-by: Claude Code:claude-opus-5-5
A requirements.txt line that pins the wired release as `===1.2.3`, `==1.2.3.0` or `==v1.2.3` installs the same upstream wheel as `==1.2.3`, but only the canonical spelling contested another lock's Socket wiring. `vex` attested `not_affected` for a project whose `pip install -r requirements.txt` ships the unpatched release. The requirements reader now records any pin that can only select one release (an `==` pin in any valid PEP 440 spelling, or `===`), and the cross-lock contest compares PyPI versions under PEP 440 equality, the way pip resolves the pin. Ranges and wildcards are still not evidence, since what they install depends on the index. Fixes #1602 Assisted-by: Claude Code:claude-opus-5-5
Review follow-ups for the pin-spelling contest: - pip compares a `===X` pin as a string, so it now contests only a wiring of exactly that version string. `===1.16` no longer withholds an attestation for release 1.16.0, which pip can't install from it. - A lock tree that wires the release itself, under another PEP 440 spelling, is no longer counted as a contester of the other lock. - Reuse purl_key::pypi_same_release instead of a second copy of it. Assisted-by: Claude Code:claude-opus-5-5
The repo's lint test requires purl types to be read through Ecosystem::from_purl rather than an inline prefix check. Assisted-by: Claude Code:claude-opus-5-5
|
BugBot review Generated by Claude Code |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
The reason will be displayed to describe this comment to others. Learn more.
Stale Bugbot comment from a previous run.
Sorry, something went wrong.
There was an error while loading. Please reload this page.
|
Labeled Ready for review (burn-down agent).
Slack announcement not sent this run (the Slack send tool was unavailable). The next run will retry. Generated by Claude Code |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
There was an error while loading. Please reload this page.
uv 0.13.2 and later refuse the `environments = []` pylock that Pipenv
2026.8.0 writes ("The target environment is not supported by the
lockfile"). setup-uv had no version pin, so the merge-queue
`e2e_vex_build pipenv::` leg started failing with no change on main,
and that dequeued this PR. Pin uv to 0.13.1, as #1639 does. The change
becomes a no-op once #1639 lands.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01FuB4p2UQANHrpx4dHRwddS
|
The merge queue dequeued this PR because a CI check failed. The failure isn't this PR's.
The PR needs to be re-queued after CI on d72ed0d passes. The push may also have dismissed the earlier approval. Generated by Claude Code |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
|
Wenxin Jiang (@Wenxin-Jiang) this changed after your approval (on Besides merges from main, the only new commit is d72ed0d: the CI-only uv pin from #1639 ( If that's fine with you, re-approving Generated by Claude Code |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
|
bugbot run Generated by Claude Code |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
The reason will be displayed to describe this comment to others. Learn more.
Stale Bugbot comment from a previous run.
Sorry, something went wrong.
There was an error while loading. Please reload this page.
|
Ready for review re-confirmed at the new head (burn-down agent).
Generated by Claude Code |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
There was an error while loading. Please reload this page.
|
The merge queue dequeued this PR again. The uv pin worked: the
fn fake_hatch(dir: &Path, marker: &Path) {
use std::os::unix::fs::PermissionsExt;
let script = dir.join("hatch");
std::fs::write(
&script,
format!(
"#!/bin/sh\n: > '{}'\necho 'Hatch, version 1.13.0'\n",
marker.display()
),
)
.unwrap();
std::fs::set_permissions(&script, std::fs::Permissions::from_mode(0o755)).unwrap();
+ // Wait out the fork/exec ETXTBSY window (a sibling test thread can
+ // still hold our write fd), so the probe under test never sees it.
+ let deadline = std::time::Instant::now() + std::time::Duration::from_secs(10);
+ loop {
+ match std::process::Command::new(&script).output() {
+ Ok(_) => break,
+ Err(e)
+ if e.kind() == std::io::ErrorKind::ExecutableFileBusy
+ && std::time::Instant::now() < deadline =>
+ {
+ std::thread::sleep(std::time::Duration::from_millis(20));
+ }
+ Err(e) => panic!("spawn the fake hatch: {e:?}"),
+ }
+ }
+ let _ = std::fs::remove_file(marker);
}Removing the marker after the priming run keeps the "the resolved hatch was not run" assertion meaningful. Re-queueing this PR is the one re-run. If Generated by Claude Code |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
#1599 (bare requirements wheel paths contest VEX) landed on main and added its own test next to this PR's #1602 tests in pypi_other.rs. Both sides only add tests; keep all of them. Co-Authored-By: Claude <[email protected]>
|
Burn-down agent: #1599 landed on Generated by Claude Code |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
|
bugbot run Generated by Claude Code |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
The reason will be displayed to describe this comment to others. Learn more.
✅ Bugbot reviewed your changes and found no new issues!
Comment @cursor review or bugbot run to trigger another review on this PR
Reviewed by Cursor Bugbot for commit 3417797. Configure here.
Sorry, something went wrong.
There was an error while loading. Please reload this page.
There was an error while loading. Please reload this page.
|
Burn-down agent: re-labeled Ready for review at
Generated by Claude Code |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
There was an error while loading. Please reload this page.
Successfully merging this pull request may close these issues.
A requirements.txt pin spelled===X, ==X.0 or ==vX doesn't contest another lock's Socket wiring of release X, so vex attests not_affected while pip install -r installs the upstream release (#1549 residual)
There was an error while loading. Please reload this page.