Repository navigation
bughunt(maven): fix probe tar path on Windows (temporary) #2
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: bughunt-maven probe | |
| on: | |
| push: | |
| branches: ['bughunt/maven/**'] | |
| permissions: | |
| contents: read | |
| jobs: | |
| probe: | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, macos-latest, windows-latest] | |
| runs-on: ${{ matrix.os }} | |
| timeout-minutes: 45 | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false | |
| - run: rustup show | |
| - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 | |
| with: | |
| save-if: false | |
| - run: cargo build --release -p socket-patch-cli | |
| - name: Probe vendored Maven wiring | |
| shell: bash | |
| run: | | |
| set +e | |
| java -version 2>&1 | head -1 | |
| PY=python3; command -v python3 >/dev/null || PY=python | |
| ROOT="$RUNNER_TEMP/bh"; mkdir -p "$ROOT/mvn"; ls "$ROOT/mvn" | |
| for v in 3.6.3 3.9.11 4.0.0-rc-7; do | |
| case $v in 4.*) u=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/$v/apache-maven-$v-bin.tar.gz;; *) u=https://archive.apache.org/dist/maven/maven-3/$v/binaries/apache-maven-$v-bin.tar.gz;; esac | |
| (cd "$ROOT/mvn" && curl -sSfL "$u" | tar xz) | |
| done | |
| cat > "$ROOT/probe.py" <<'PYEOF' | |
| import os, sys, json, zipfile, hashlib, subprocess, shutil, tempfile | |
| ROOT = os.environ["ROOT"]; SP = os.path.abspath("target/release/socket-patch" + (".exe" if os.name == "nt" else "")) | |
| WIN = os.name == "nt" | |
| def mvnbin(v): return os.path.join(ROOT, "mvn", "apache-maven-" + v, "bin", "mvn.cmd" if WIN else "mvn") | |
| POM = '<project xmlns="http://maven.apache.org/POM/4.0.0"><modelVersion>4.0.0</modelVersion>\n<groupId>com.example</groupId><artifactId>app</artifactId><version>1.0.0</version>\n%s<dependencies><dependency><groupId>org.apache.commons</groupId><artifactId>commons-text</artifactId><version>1.10.0</version></dependency></dependencies>\n</project>\n' | |
| M2 = os.path.join(ROOT, "m2") | |
| def mvn(v, proj, lr, extra=()): | |
| s = os.path.join(lr + ".settings.xml") | |
| open(s, "w").write("<settings><localRepository>%s</localRepository></settings>" % lr) | |
| r = subprocess.run([mvnbin(v), "-B", "-s", s, "org.apache.maven.plugins:maven-dependency-plugin:3.1.2:copy-dependencies", *extra], cwd=proj, capture_output=True, text=True, shell=WIN) | |
| return r | |
| # warm | |
| w = os.path.join(ROOT, "warm"); os.makedirs(w, exist_ok=True); open(os.path.join(w, "pom.xml"), "w").write(POM % "") | |
| r = mvn("3.9.11", w, M2); print("warm exit", r.returncode) | |
| if r.returncode: print(r.stdout[-3000:]) | |
| jar = os.path.join(M2, "org/apache/commons/commons-text/1.10.0/commons-text-1.10.0.jar") | |
| orig = zipfile.ZipFile(jar).read("META-INF/NOTICE.txt"); after = orig + b"\nSOCKET-PATCH-MAVEN-E2E-MARKER\n" | |
| g = lambda d: hashlib.sha256(b"blob %d\0" % len(d) + d).hexdigest() | |
| uuid = "5e6f7081-92a3-4b4c-8d5e-6f708192a3b4" | |
| def stage(p): | |
| rec = {"uuid": uuid, "exportedAt": "2026-01-01T00:00:00Z", "files": {"META-INF/NOTICE.txt": {"beforeHash": g(orig), "afterHash": g(after)}}, | |
| "vulnerabilities": {"GHSA-x": {"cves": ["CVE-2026-1"], "summary": "s", "severity": "high", "description": "d"}}, "description": "d", "license": "MIT", "tier": "free"} | |
| os.makedirs(os.path.join(p, ".socket", "blobs"), exist_ok=True) | |
| json.dump({"patches": {"pkg:maven/org.apache.commons/commons-text@1.10.0": rec}}, open(os.path.join(p, ".socket", "manifest.json"), "w")) | |
| open(os.path.join(p, ".socket", "blobs", g(after)), "wb").write(after) | |
| cases = [("plain", "plain/proj", ""), ("space", "sp ace/proj", ""), ("pct2F", "ws/app_feature%2Fcve/proj", ""), ("selfclose-repos", "sc/proj", "<repositories/>\n")] | |
| env = dict(os.environ, SOCKET_TELEMETRY_DISABLED="1", SOCKET_NO_CONFIG="1", MAVEN_REPO_LOCAL=M2) | |
| for name, rel, extra in cases: | |
| p = os.path.join(ROOT, "c", rel); os.makedirs(p, exist_ok=True) | |
| open(os.path.join(p, "pom.xml"), "w").write(POM % extra); stage(p) | |
| vr = subprocess.run([SP, "vendor", "--json", "--offline", "--cwd", p], capture_output=True, text=True, env=env) | |
| shutil.rmtree(os.path.join(p, ".socket", "blobs")); os.remove(os.path.join(p, ".socket", "manifest.json")) | |
| if name == "plain": print(open(os.path.join(p, "pom.xml")).read()) | |
| for v in ["3.6.3", "3.9.11", "4.0.0-rc-7"]: | |
| shutil.rmtree(os.path.join(p, "target"), ignore_errors=True) | |
| lr = tempfile.mkdtemp(dir=ROOT) | |
| r = mvn(v, p, lr) | |
| dj = os.path.join(p, "target", "dependency", "commons-text-1.10.0.jar") | |
| st = "NOJAR" | |
| if os.path.exists(dj): st = "PATCHED" if b"MARKER" in zipfile.ZipFile(dj).read("META-INF/NOTICE.txt") else "PRISTINE" | |
| src = [l for l in r.stdout.splitlines() if "Downloaded from" in l and "commons-text-1.10.0.jar" in l] | |
| errs = [l for l in r.stdout.splitlines() if l.startswith("[ERROR]")][:3] | |
| print("RESULT os=%s case=%s mvn=%s vendor_exit=%d mvn_exit=%d %s | %s | %s" % (sys.platform, name, v, vr.returncode, r.returncode, st, src[:1], errs)) | |
| PYEOF | |
| ROOT="$ROOT" $PY "$ROOT/probe.py" |