|
| 1 | +name: bughunt-maven probe |
| 2 | +on: |
| 3 | + push: |
| 4 | + branches: ['bughunt/maven/**'] |
| 5 | +permissions: |
| 6 | + contents: read |
| 7 | +jobs: |
| 8 | + probe: |
| 9 | + strategy: |
| 10 | + fail-fast: false |
| 11 | + matrix: |
| 12 | + os: [ubuntu-latest, macos-latest, windows-latest] |
| 13 | + runs-on: ${{ matrix.os }} |
| 14 | + timeout-minutes: 45 |
| 15 | + steps: |
| 16 | + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 |
| 17 | + with: |
| 18 | + persist-credentials: false |
| 19 | + - run: rustup show |
| 20 | + - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 |
| 21 | + with: |
| 22 | + save-if: false |
| 23 | + - run: cargo build --release -p socket-patch-cli |
| 24 | + - name: Probe vendored Maven wiring |
| 25 | + shell: bash |
| 26 | + run: | |
| 27 | + set +e |
| 28 | + java -version 2>&1 | head -1 |
| 29 | + PY=python3; command -v python3 >/dev/null || PY=python |
| 30 | + ROOT="$RUNNER_TEMP/bh"; mkdir -p "$ROOT/mvn" |
| 31 | + for v in 3.6.3 3.9.11 4.0.0-rc-7; do |
| 32 | + case $v in 4.*) u=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/$v/apache-maven-$v-bin.tar.gz;; *) u=https://archive.apache.org/dist/maven/maven-3/$v/binaries/apache-maven-$v-bin.tar.gz;; esac |
| 33 | + curl -sSfL "$u" | tar xz -C "$ROOT/mvn" |
| 34 | + done |
| 35 | + cat > "$ROOT/probe.py" <<'PYEOF' |
| 36 | + import os, sys, json, zipfile, hashlib, subprocess, shutil, tempfile |
| 37 | + ROOT = os.environ["ROOT"]; SP = os.path.abspath("target/release/socket-patch" + (".exe" if os.name == "nt" else "")) |
| 38 | + WIN = os.name == "nt" |
| 39 | + def mvnbin(v): return os.path.join(ROOT, "mvn", "apache-maven-" + v, "bin", "mvn.cmd" if WIN else "mvn") |
| 40 | + POM = '<project xmlns="http://maven.apache.org/POM/4.0.0"><modelVersion>4.0.0</modelVersion>\n<groupId>com.example</groupId><artifactId>app</artifactId><version>1.0.0</version>\n%s<dependencies><dependency><groupId>org.apache.commons</groupId><artifactId>commons-text</artifactId><version>1.10.0</version></dependency></dependencies>\n</project>\n' |
| 41 | + M2 = os.path.join(ROOT, "m2") |
| 42 | + def mvn(v, proj, lr, extra=()): |
| 43 | + s = os.path.join(lr + ".settings.xml") |
| 44 | + open(s, "w").write("<settings><localRepository>%s</localRepository></settings>" % lr) |
| 45 | + r = subprocess.run([mvnbin(v), "-B", "-s", s, "org.apache.maven.plugins:maven-dependency-plugin:3.1.2:copy-dependencies", *extra], cwd=proj, capture_output=True, text=True, shell=WIN) |
| 46 | + return r |
| 47 | + # warm |
| 48 | + w = os.path.join(ROOT, "warm"); os.makedirs(w, exist_ok=True); open(os.path.join(w, "pom.xml"), "w").write(POM % "") |
| 49 | + r = mvn("3.9.11", w, M2); print("warm exit", r.returncode) |
| 50 | + if r.returncode: print(r.stdout[-3000:]) |
| 51 | + jar = os.path.join(M2, "org/apache/commons/commons-text/1.10.0/commons-text-1.10.0.jar") |
| 52 | + orig = zipfile.ZipFile(jar).read("META-INF/NOTICE.txt"); after = orig + b"\nSOCKET-PATCH-MAVEN-E2E-MARKER\n" |
| 53 | + g = lambda d: hashlib.sha256(b"blob %d\0" % len(d) + d).hexdigest() |
| 54 | + uuid = "5e6f7081-92a3-4b4c-8d5e-6f708192a3b4" |
| 55 | + def stage(p): |
| 56 | + rec = {"uuid": uuid, "exportedAt": "2026-01-01T00:00:00Z", "files": {"META-INF/NOTICE.txt": {"beforeHash": g(orig), "afterHash": g(after)}}, |
| 57 | + "vulnerabilities": {"GHSA-x": {"cves": ["CVE-2026-1"], "summary": "s", "severity": "high", "description": "d"}}, "description": "d", "license": "MIT", "tier": "free"} |
| 58 | + os.makedirs(os.path.join(p, ".socket", "blobs"), exist_ok=True) |
| 59 | + json.dump({"patches": {"pkg:maven/org.apache.commons/commons-text@1.10.0": rec}}, open(os.path.join(p, ".socket", "manifest.json"), "w")) |
| 60 | + open(os.path.join(p, ".socket", "blobs", g(after)), "wb").write(after) |
| 61 | + cases = [("plain", "plain/proj", ""), ("space", "sp ace/proj", ""), ("pct2F", "ws/app_feature%2Fcve/proj", ""), ("selfclose-repos", "sc/proj", "<repositories/>\n")] |
| 62 | + env = dict(os.environ, SOCKET_TELEMETRY_DISABLED="1", SOCKET_NO_CONFIG="1", MAVEN_REPO_LOCAL=M2) |
| 63 | + for name, rel, extra in cases: |
| 64 | + p = os.path.join(ROOT, "c", rel); os.makedirs(p, exist_ok=True) |
| 65 | + open(os.path.join(p, "pom.xml"), "w").write(POM % extra); stage(p) |
| 66 | + vr = subprocess.run([SP, "vendor", "--json", "--offline", "--cwd", p], capture_output=True, text=True, env=env) |
| 67 | + shutil.rmtree(os.path.join(p, ".socket", "blobs")); os.remove(os.path.join(p, ".socket", "manifest.json")) |
| 68 | + if name == "plain": print(open(os.path.join(p, "pom.xml")).read()) |
| 69 | + for v in ["3.6.3", "3.9.11", "4.0.0-rc-7"]: |
| 70 | + shutil.rmtree(os.path.join(p, "target"), ignore_errors=True) |
| 71 | + lr = tempfile.mkdtemp(dir=ROOT) |
| 72 | + r = mvn(v, p, lr) |
| 73 | + dj = os.path.join(p, "target", "dependency", "commons-text-1.10.0.jar") |
| 74 | + st = "NOJAR" |
| 75 | + if os.path.exists(dj): st = "PATCHED" if b"MARKER" in zipfile.ZipFile(dj).read("META-INF/NOTICE.txt") else "PRISTINE" |
| 76 | + src = [l for l in r.stdout.splitlines() if "Downloaded from" in l and "commons-text-1.10.0.jar" in l] |
| 77 | + errs = [l for l in r.stdout.splitlines() if l.startswith("[ERROR]")][:3] |
| 78 | + print("RESULT os=%s case=%s mvn=%s vendor_exit=%d mvn_exit=%d %s | %s | %s" % (sys.platform, name, v, vr.returncode, r.returncode, st, src[:1], errs)) |
| 79 | + PYEOF |
| 80 | + ROOT="$ROOT" $PY "$ROOT/probe.py" |
0 commit comments