|
| 1 | +name: bughunt poetry probe |
| 2 | + |
| 3 | +on: |
| 4 | + push: |
| 5 | + branches: ['bughunt/poetry/**'] |
| 6 | + |
| 7 | +permissions: |
| 8 | + contents: read |
| 9 | + |
| 10 | +jobs: |
| 11 | + probe: |
| 12 | + strategy: |
| 13 | + fail-fast: false |
| 14 | + matrix: |
| 15 | + os: [ubuntu-latest, macos-latest, windows-latest] |
| 16 | + poetry: ['1.8.5', '2.4.3'] |
| 17 | + runs-on: ${{ matrix.os }} |
| 18 | + timeout-minutes: 45 |
| 19 | + env: |
| 20 | + SOCKET_NO_CONFIG: '1' |
| 21 | + SOCKET_NO_UPDATE_CHECK: '1' |
| 22 | + steps: |
| 23 | + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 |
| 24 | + with: |
| 25 | + persist-credentials: false |
| 26 | + - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 |
| 27 | + with: |
| 28 | + python-version: '3.12' |
| 29 | + - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 |
| 30 | + with: |
| 31 | + key: bughunt-poetry |
| 32 | + save-if: false |
| 33 | + - run: cargo build --locked -p socket-patch-cli |
| 34 | + - name: Install Poetry |
| 35 | + shell: bash |
| 36 | + run: | |
| 37 | + python -m venv "$RUNNER_TEMP/poetry-venv" |
| 38 | + if [ -x "$RUNNER_TEMP/poetry-venv/Scripts/python.exe" ]; then PY="$RUNNER_TEMP/poetry-venv/Scripts/python.exe"; P="$RUNNER_TEMP/poetry-venv/Scripts/poetry.exe"; else PY="$RUNNER_TEMP/poetry-venv/bin/python"; P="$RUNNER_TEMP/poetry-venv/bin/poetry"; fi |
| 39 | + "$PY" -m pip install -q "poetry==${{ matrix.poetry }}" |
| 40 | + echo "POETRY_BIN=$P" >> "$GITHUB_ENV" |
| 41 | + - name: Probe Poetry agent/hosted/vendored |
| 42 | + shell: bash |
| 43 | + run: | |
| 44 | + cat > "$RUNNER_TEMP/probe.py" <<'PROBE_EOF' |
| 45 | + import base64, hashlib, io, json, os, re, shutil, subprocess, sys, tempfile, threading, urllib.request, zipfile |
| 46 | + from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer |
| 47 | +
|
| 48 | + CLI = os.path.abspath(sys.argv[1]); POETRY = sys.argv[2] |
| 49 | + UUID = "3c5e7a9b-1d3f-4b5d-8f7a-9b1d3f5a7c9e" |
| 50 | + WHL = "https://files.pythonhosted.org/packages/d9/5a/e7c31adbe875f2abbb91bd84cf2dc52d792b5a01506781dbcf25c91daf11/six-1.16.0-py2.py3-none-any.whl" |
| 51 | + RAW = urllib.request.urlopen(WHL).read() |
| 52 | + before = zipfile.ZipFile(io.BytesIO(RAW)).read("six.py") |
| 53 | + after = before + b"\n# SOCKET-PATCHED\nSOCKET_PATCHED = 1\n" |
| 54 | + def build(): |
| 55 | + zin = zipfile.ZipFile(io.BytesIO(RAW)); out = io.BytesIO(); zout = zipfile.ZipFile(out, "w", zipfile.ZIP_DEFLATED) |
| 56 | + rec = [n for n in zin.namelist() if n.endswith(".dist-info/RECORD")][0]; lines = [] |
| 57 | + for n in zin.namelist(): |
| 58 | + if n == rec: continue |
| 59 | + d = after if n == "six.py" else zin.read(n); zout.writestr(n, d) |
| 60 | + lines.append("%s,sha256=%s,%d" % (n, base64.urlsafe_b64encode(hashlib.sha256(d).digest()).rstrip(b"=").decode(), len(d))) |
| 61 | + lines.append(rec + ",,"); zout.writestr(rec, "\n".join(lines) + "\n"); zout.close(); return out.getvalue() |
| 62 | + g = lambda b: hashlib.sha256(b"blob %d\0" % len(b) + b).hexdigest() |
| 63 | + API_PURL = "pkg:pypi/six@1.16.0?artifact_id=py2-py3-none-any-whl" |
| 64 | + VIEW = {"uuid": UUID, "purl": API_PURL, "publishedAt": "2026-09-01T00:00:00Z", |
| 65 | + "files": {"six.py": {"beforeHash": g(before), "afterHash": g(after), "blobContent": base64.b64encode(after).decode()}}, |
| 66 | + "vulnerabilities": {"GHSA-aaaa-bbbb-cccc": {"cves": ["CVE-2026-0001"], "summary": "s", "severity": "high", "description": "d"}}, |
| 67 | + "description": "x", "license": "MIT", "tier": "free"} |
| 68 | + PATCH = {"uuid": UUID, "purl": API_PURL, "tier": "free", "cveIds": ["CVE-2026-0001"], "ghsaIds": ["GHSA-aaaa-bbbb-cccc"], "severity": "HIGH", "title": "t"} |
| 69 | +
|
| 70 | +
|
| 71 | + class H(BaseHTTPRequestHandler): |
| 72 | + def log_message(self, *a): pass |
| 73 | + def out(self, obj): |
| 74 | + b = json.dumps(obj).encode(); self.send_response(200); self.send_header("Content-Type", "application/json") |
| 75 | + self.send_header("Content-Length", str(len(b))); self.end_headers(); self.wfile.write(b) |
| 76 | + def do_GET(self): |
| 77 | + if "/patches/view/" in self.path: return self.out(VIEW) |
| 78 | + if self.path.startswith("/patch/pypi/"): |
| 79 | + self.send_response(200); self.send_header("Content-Length", str(len(WHEEL))); self.end_headers(); self.wfile.write(WHEEL); return |
| 80 | + if "/by-package/" in self.path: return self.out({"patches": [dict(PATCH, publishedAt="2026-09-01T00:00:00Z", description="x", license="MIT", vulnerabilities={})], "canAccessPaidPatches": False}) |
| 81 | + self.send_response(404); self.end_headers() |
| 82 | + def do_POST(self): |
| 83 | + raw = self.rfile.read(int(self.headers.get("Content-Length") or 0)).decode() |
| 84 | + if self.path.endswith("/patches/batch"): |
| 85 | + has = "pkg:pypi/six@1.16.0" in raw |
| 86 | + return self.out({"packages": [{"purl": "pkg:pypi/six@1.16.0", "patches": [PATCH]}] if has else [], "canAccessPaidPatches": False}) |
| 87 | + if self.path.endswith("/patches/package"): |
| 88 | + url = API + "/patch/pypi/six/1.16.0/11111111-2222-4333-8444-555555555555/" + UUID + "/six-1.16.0-py2.py3-none-any.whl" |
| 89 | + return self.out({"results": {UUID: {"status": "granted", "url": url, "purl": "pkg:pypi/six@1.16.0", |
| 90 | + "artifacts": [{"kind": "tarball", "url": url, "integrity": {"sha256": hashlib.sha256(WHEEL).hexdigest()}}], "registryOverride": None}}}) |
| 91 | + self.out({}) |
| 92 | +
|
| 93 | +
|
| 94 | + srv = ThreadingHTTPServer(("127.0.0.1", 0), H); threading.Thread(target=srv.serve_forever, daemon=True).start() |
| 95 | + API = "http://127.0.0.1:%d" % srv.server_address[1] |
| 96 | + WHEEL = build() |
| 97 | +
|
| 98 | + NAMED = '[tool.poetry]\nname = "probe-named"\npackage-mode = false\n\n[tool.poetry.dependencies]\npython = ">=3.8"\nsix = "1.16.0"\n' |
| 99 | + NAMELESS = '[tool.poetry]\npackage-mode = false\n\n[tool.poetry.dependencies]\npython = ">=3.8"\nsix = "1.16.0"\n' |
| 100 | + BOTH = '[project]\nname = "pep-name"\nversion = "0.1.0"\nrequires-python = ">=3.8"\ndependencies = ["six==1.16.0"]\n\n[tool.poetry]\nname = "legacy-name"\npackage-mode = false\n' |
| 101 | + env = {k: v for k, v in os.environ.items() if not k.startswith(("POETRY_", "VIRTUAL_ENV"))} |
| 102 | + env.update(POETRY_NO_INTERACTION="1", SOCKET_API_URL=API, SOCKET_API_TOKEN="fake", SOCKET_ORG_SLUG="test-org", |
| 103 | + SOCKET_NO_CONFIG="1", SOCKET_NO_UPDATE_CHECK="1", SOCKET_TELEMETRY_DISABLED="1") |
| 104 | + ver = subprocess.run([POETRY, "--version"], capture_output=True, text=True).stdout.strip() |
| 105 | + base = os.path.realpath(os.path.join(os.environ.get("GITHUB_WORKSPACE", tempfile.gettempdir()), "..", "bughunt-probe")) |
| 106 | + os.makedirs(base, exist_ok=True) |
| 107 | + rows = [] |
| 108 | + def run(args, d, e=env): |
| 109 | + return subprocess.run(args, cwd=d, env=e, capture_output=True, text=True) |
| 110 | + def six_file(d, e=env): |
| 111 | + return run([POETRY, "run", "python", "-c", "import six;print(six.__file__)"], d, e).stdout.strip() |
| 112 | + def patched(f): |
| 113 | + return "PATCHED" if f and os.path.isfile(f) and b"SOCKET_PATCHED" in open(f, "rb").read() else "UNPATCHED(%s)" % f |
| 114 | + def j(s): |
| 115 | + try: return json.loads(s.stdout[s.stdout.find("{"):]) |
| 116 | + except Exception: return {"nojson": (s.stdout + s.stderr)[-400:]} |
| 117 | +
|
| 118 | + d = os.path.join(base, "agent-named"); os.makedirs(d) |
| 119 | + open(os.path.join(d, "pyproject.toml"), "w").write(NAMED) |
| 120 | + run([POETRY, "install", "--no-root"], d) |
| 121 | + venv = run([POETRY, "env", "info", "-p"], d).stdout.strip() |
| 122 | + out = j(run([CLI, "scan", "--mode", "agent", "--json", "--yes"], d)) |
| 123 | + rows.append(("agent-named-longpath", str([(p.get("action"), p.get("errorCode")) for p in out.get("apply", {}).get("patches", [])]), "scanned=%s" % out.get("scannedPackages"), venv, patched(six_file(d)))) |
| 124 | + rows.append((" realpath(cwd)", os.path.realpath(d), "", "", "")) |
| 125 | +
|
| 126 | + ienv = dict(env, POETRY_VIRTUALENVS_IN_PROJECT="true") |
| 127 | + for mode in ("hosted", "vendored"): |
| 128 | + for eol in ("lf", "crlf"): |
| 129 | + d = os.path.join(base, "%s-%s" % (mode, eol)); os.makedirs(d) |
| 130 | + open(os.path.join(d, "pyproject.toml"), "w").write(NAMED.replace("probe-named", "probe-%s-%s" % (mode, eol))) |
| 131 | + run([POETRY, "lock"], d, ienv) |
| 132 | + lock = os.path.join(d, "poetry.lock") |
| 133 | + if eol == "crlf": |
| 134 | + b = open(lock, "rb").read().replace(b"\r\n", b"\n").replace(b"\n", b"\r\n"); open(lock, "wb").write(b) |
| 135 | + orig = open(lock, "rb").read() |
| 136 | + s = run([CLI, "scan", "--mode", mode, "--json", "--yes"], d, ienv); o = j(s) |
| 137 | + summ = o.get("redirect") or o.get("status") |
| 138 | + ev = [(e.get("action"), e.get("errorCode")) for e in o.get("vendor", {}).get("events", [])] |
| 139 | + chk = run([POETRY, "check", "--lock"], d, ienv) |
| 140 | + inst = run([POETRY, "install", "--no-root"], d, ienv) |
| 141 | + f = six_file(d, ienv) |
| 142 | + rb = run([CLI, "rollback", "--json", "--yes"], d, ienv) |
| 143 | + exact = open(lock, "rb").read() == orig |
| 144 | + rows.append(("%s-%s" % (mode, eol), "scan exit=%d %s %s" % (s.returncode, str(summ)[:160], ev), |
| 145 | + "check=%d install=%d %s" % (chk.returncode, inst.returncode, (inst.stdout + inst.stderr)[-200:].replace("\n", " ")), |
| 146 | + patched(f), "rollback exit=%d exact=%s" % (rb.returncode, exact))) |
| 147 | + print("== %s | %s | base=%s" % (ver, sys.platform, base)) |
| 148 | + for r in rows: print(" | ".join(r)) |
| 149 | + PROBE_EOF |
| 150 | + CLI="$PWD/target/debug/socket-patch"; [ -f "$CLI.exe" ] && CLI="$CLI.exe" |
| 151 | + python "$RUNNER_TEMP/probe.py" "$CLI" "$POETRY_BIN" |
0 commit comments