bughunt pip probe: requirements hash-checking mode #1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: bughunt pip probe | |
| on: | |
| push: | |
| branches: ['bughunt/pip/**'] | |
| permissions: | |
| contents: read | |
| jobs: | |
| probe: | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, macos-latest, windows-latest] | |
| python: ['3.8', '3.13'] | |
| pip: ['20.3.4', '23.3.2', 'latest'] | |
| exclude: | |
| - python: '3.13' | |
| pip: '20.3.4' | |
| runs-on: ${{ matrix.os }} | |
| timeout-minutes: 45 | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 | |
| with: | |
| python-version: ${{ matrix.python }} | |
| - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 | |
| with: | |
| key: bughunt-pip | |
| save-if: false | |
| - run: cargo build --locked -p socket-patch-cli | |
| - name: Probe | |
| shell: bash | |
| run: | | |
| mkdir -p "$RUNNER_TEMP/bh" | |
| cat > "$RUNNER_TEMP/bh/mock.py" <<'MOCK_EOF' | |
| import base64, hashlib, io, json, sys, zipfile | |
| from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer | |
| PORT=int(sys.argv[1]); RAW=open(sys.argv[2],'rb').read() | |
| UUID="3c5e7a9b-1d3f-4b5d-8f7a-9b1d3f5a7c9e" | |
| before=zipfile.ZipFile(io.BytesIO(RAW)).read("six.py"); after=before+b"\n# SOCKET-PATCHED\nSOCKET_PATCHED = 1\n" | |
| def build(): | |
| zin=zipfile.ZipFile(io.BytesIO(RAW)); out=io.BytesIO(); zout=zipfile.ZipFile(out,"w",zipfile.ZIP_DEFLATED) | |
| rec=[n for n in zin.namelist() if n.endswith(".dist-info/RECORD")][0]; lines=[] | |
| for n in zin.namelist(): | |
| if n==rec: continue | |
| d=after if n=="six.py" else zin.read(n); zout.writestr(n,d) | |
| lines.append("%s,sha256=%s,%d"%(n,base64.urlsafe_b64encode(hashlib.sha256(d).digest()).rstrip(b"=").decode(),len(d))) | |
| lines.append(rec+",,"); zout.writestr(rec,"\n".join(lines)+"\n"); zout.close(); return out.getvalue() | |
| WHEEL=build() | |
| g=lambda b: hashlib.sha256(b"blob %d\0"%len(b)+b).hexdigest() | |
| API_PURL="pkg:pypi/six@1.16.0?artifact_id=py2-py3-none-any-whl" | |
| VIEW={"uuid":UUID,"purl":API_PURL,"publishedAt":"2026-09-01T00:00:00Z","files":{"six.py":{"beforeHash":g(before),"afterHash":g(after),"blobContent":base64.b64encode(after).decode()}}, | |
| "vulnerabilities":{"GHSA-aaaa-bbbb-cccc":{"cves":["CVE-2026-0001"],"summary":"s","severity":"high","description":"d"}},"description":"x","license":"MIT","tier":"free"} | |
| PATCH={"uuid":UUID,"purl":API_PURL,"tier":"free","cveIds":["CVE-2026-0001"],"ghsaIds":["GHSA-aaaa-bbbb-cccc"],"severity":"HIGH","title":"t"} | |
| API="http://127.0.0.1:%d"%PORT | |
| class H(BaseHTTPRequestHandler): | |
| def log_message(self,*a): sys.stderr.write("REQ %s %s\n"%(self.command,self.path)) | |
| def out(self,obj): | |
| b=json.dumps(obj).encode(); self.send_response(200); self.send_header("Content-Type","application/json"); self.send_header("Content-Length",str(len(b))); self.end_headers(); self.wfile.write(b) | |
| def do_GET(self): | |
| if "/patches/view/" in self.path: return self.out(VIEW) | |
| if "/blob/" in self.path: | |
| h=self.path.rsplit('/',1)[1] | |
| for d in (before,after): | |
| if g(d)==h: self.send_response(200); self.send_header("Content-Length",str(len(d))); self.end_headers(); self.wfile.write(d); return | |
| if self.path.startswith("/patch/pypi/"): | |
| self.send_response(200); self.send_header("Content-Length",str(len(WHEEL))); self.end_headers(); self.wfile.write(WHEEL); return | |
| if "/by-package/" in self.path: return self.out({"patches":[dict(PATCH,publishedAt="2026-09-01T00:00:00Z",description="x",license="MIT",vulnerabilities={})],"canAccessPaidPatches":False}) | |
| self.send_response(404); self.end_headers() | |
| def do_POST(self): | |
| raw=self.rfile.read(int(self.headers.get("Content-Length") or 0)).decode() | |
| sys.stderr.write("BODY %s\n"%raw[:300]) | |
| if self.path.endswith("/patches/batch"): | |
| has="pkg:pypi/six@1.16.0" in raw | |
| return self.out({"packages":[{"purl":"pkg:pypi/six@1.16.0","patches":[PATCH]}] if has else [],"canAccessPaidPatches":False}) | |
| if self.path.endswith("/patches/package"): | |
| url=API+"/patch/pypi/six/1.16.0/11111111-2222-4333-8444-555555555555/"+UUID+"/six-1.16.0-py2.py3-none-any.whl" | |
| return self.out({"results":{UUID:{"status":"granted","url":url,"purl":"pkg:pypi/six@1.16.0","artifacts":[{"kind":"tarball","url":url,"integrity":{"sha256":hashlib.sha256(WHEEL).hexdigest()}}],"registryOverride":None}}}) | |
| self.out({}) | |
| ThreadingHTTPServer(("127.0.0.1",PORT),H).serve_forever() | |
| MOCK_EOF | |
| cat > "$RUNNER_TEMP/bh/probe.py" <<'PROBE_EOF' | |
| import json, os, subprocess, sys, shutil, threading, runpy, tempfile, urllib.request | |
| CLI = os.path.abspath(sys.argv[1]); PIPV = sys.argv[2]; PY = sys.executable | |
| WHL = "https://files.pythonhosted.org/packages/d9/5a/e7c31adbe875f2abbb91bd84cf2dc52d792b5a01506781dbcf25c91daf11/six-1.16.0-py2.py3-none-any.whl" | |
| tmp = os.path.realpath(os.path.join(os.environ.get("RUNNER_TEMP", tempfile.gettempdir()), "bhpip")); os.makedirs(tmp, exist_ok=True) | |
| raw = os.path.join(tmp, "six.whl"); open(raw, "wb").write(urllib.request.urlopen(WHL).read()) | |
| PORT = 18080 | |
| threading.Thread(target=lambda: (sys.argv.__setitem__(slice(1, None), [str(PORT), raw]), runpy.run_path(os.path.join(os.path.dirname(__file__), "mock.py"))), daemon=True).start() | |
| import time; time.sleep(2) | |
| env = dict(os.environ, SOCKET_API_URL="http://127.0.0.1:%d" % PORT, SOCKET_API_TOKEN="fake", SOCKET_ORG_SLUG="test-org", SOCKET_NO_CONFIG="1", SOCKET_NO_UPDATE_CHECK="1", SOCKET_TELEMETRY_DISABLED="1", PIP_DISABLE_PIP_VERSION_CHECK="1") | |
| env.pop("VIRTUAL_ENV", None) | |
| def run(a, d): return subprocess.run(a, cwd=d, env=env, capture_output=True, text=True) | |
| def vpy(v): return os.path.join(v, "Scripts", "python.exe") if os.name == "nt" else os.path.join(v, "bin", "python") | |
| HASHED = "six==1.16.0 \\\n --hash=sha256:8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254\n" | |
| rows = [] | |
| def pipinstall(d): | |
| v = os.path.join(d, "fresh"); run([PY, "-m", "venv", v], d) | |
| run([vpy(v), "-m", "pip", "install", "-q", "pip==" + PIPV], d) | |
| r = run([vpy(v), "-m", "pip", "install", "-r", "requirements.txt"], d) | |
| err = [l for l in (r.stdout + r.stderr).splitlines() if l.startswith("ERROR")] | |
| st = run([vpy(v), "-c", "import six;print('PATCHED' if hasattr(six,'SOCKET_PATCHED') else 'UNPATCHED')"], d).stdout.strip() or "absent" | |
| return "pip-exit=%d %s %s" % (r.returncode, st, (err[0][:110] if err else "")) | |
| for case, content, mode in [("hosted-unhashed", "six==1.16.0\nidna==3.7\n", "hosted"), ("vendored-unhashed", "six==1.16.0\nidna==3.7\n", "vendored"), ("hosted-control-single", "six==1.16.0\n", "hosted"), ("setup-hashed", HASHED, "setup")]: | |
| d = os.path.join(tmp, case); shutil.rmtree(d, ignore_errors=True); os.makedirs(d) | |
| run(["git", "init", "-q", "."], d) | |
| open(os.path.join(d, "requirements.txt"), "w", newline="").write(content) | |
| if mode == "vendored": | |
| run([PY, "-m", "venv", ".venv"], d); run([vpy(os.path.join(d, ".venv")), "-m", "pip", "install", "-q", "-r", "requirements.txt"], d) | |
| if mode == "setup": | |
| s = run([CLI, "setup", "--yes", "--json"], d) | |
| else: | |
| s = run([CLI, "scan", "--mode", mode, "--json", "--yes"], d) | |
| try: st = json.loads(s.stdout[s.stdout.find("{"):]).get("status") | |
| except Exception: st = "nojson" | |
| req = open(os.path.join(d, "requirements.txt")).read().replace("\n", "\\n") | |
| rows.append("%s | cli-exit=%d %s | %s | %s" % (case, s.returncode, st, pipinstall(d), req[-70:])) | |
| print("== pip %s | python %s | %s" % (PIPV, sys.version.split()[0], sys.platform)) | |
| for r in rows: print(r) | |
| PROBE_EOF | |
| CLI="$PWD/target/debug/socket-patch"; [ -f "$CLI.exe" ] && CLI="$CLI.exe" | |
| python "$RUNNER_TEMP/bh/probe.py" "$CLI" "${{ matrix.pip }}" |