Merge origin/main into arch-refactor/872-registry-timeouts

Take main's jvm_jar.rs and utils/digest.rs: #878 landed the digest
helper port this branch had carried, so the branch keeps only its
registry_fetch/maven_repo timeout change.

Co-Authored-By: Claude <noreply@anthropic.com>

Author: claude

.gitattributes

@@ -38,3 +38,12 @@ crates/socket-patch-cli/tests/fixtures/legacy-ledgers/** -text
 # include_str! and written into user repos byte for byte; a CRLF checkout would change it.
 crates/socket-patch-core/src/vendor/jvm/socket-patch.settings.gradle -text
 crates/socket-patch-core/src/patch/redirect/socket-patch.hosted.settings.gradle -text
+
+# sbt resolution evidence is real sbt output (JSON, Ivy XML and the 0.13
+# binary update cache); the evidence parser's tests read it byte for byte.
+crates/socket-patch-core/tests/fixtures/sbt/** -text
+
+# The sbt harness scripts run under bash on the Windows legs too
+# (sbt-compatibility.yml); a CRLF checkout breaks them ($'\r').
+scripts/sbt-warm-seed.sh text eol=lf
+scripts/sbt-compat-matrix.sh text eol=lf

.github/workflows/ci.yml

@@ -240,6 +240,8 @@ jobs:
         os: [macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     timeout-minutes: 50
+    env:
+      VEXCTL_VERSION: v0.3.0
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -264,6 +266,7 @@ jobs:
         run: cargo build --workspace
 
       - name: Install Go (for vexctl)
+        id: go
         # The `vex` subcommand emits OpenVEX documents; tests/e2e_vex.rs
         # validates the output with vexctl when it's on PATH. vexctl is
         # a Go binary distributed via `go install`. Setting up Go here
@@ -279,6 +282,19 @@ jobs:
           go-version: '1.24'
           cache: false
 
+      - name: Restore vexctl (macOS)
+        # The macOS compile below took a median 110s (max 168s) of every
+        # macOS `test` job and is the step's only network flake source
+        # (sum.golang.org resets). Its output depends only on the vexctl
+        # version, the Go toolchain and the runner, so it is cached under
+        # exactly those. Saved from main only, like the cargo cache.
+        id: vexctl-cache
+        if: runner.os == 'macOS'
+        uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
+        with:
+          path: ${{ runner.temp }}/vexctl-bin
+          key: vexctl-${{ env.VEXCTL_VERSION }}-go${{ steps.go.outputs.go-version }}-${{ runner.os }}-${{ runner.arch }}
+
       - name: Install vexctl
         # Linux / Windows: the v0.3.0 release binary, checked against the
         # sha256 pinned here (from the release's vexctl_checksums.txt).
@@ -292,45 +308,64 @@ jobs:
         # sum.golang.org checksum tiles, and transient INTERNAL_ERROR
         # stream resets there have failed this step on otherwise-green
         # runs. The backoff rides out short resets; a persistent outage
-        # still fails loudly on the last attempt.
+        # still fails loudly on the last attempt. A binary restored by the
+        # step above skips the compile.
+        #
+        # --ssl-revoke-best-effort: Windows curl (schannel) otherwise fails
+        # the TLS handshake with CRYPT_E_REVOCATION_OFFLINE whenever the
+        # CA's revocation server is unreachable. A revoked certificate still
+        # fails, and the sha256 check follows. A no-op on other OSes.
         #
         # Either way the binary's directory goes on PATH so
         # `Command::new("vexctl")` in the tests resolves.
         shell: bash
         env:
-          VEXCTL_VERSION: v0.3.0
           VEXCTL_SHA256_LINUX_AMD64: cd7f8b57d20642166ed4eb3dd1fd849bbb30bbd7c5b9f5b0316b6003b57ceaba
           VEXCTL_SHA256_WINDOWS_AMD64: 346fb3104b656fe1a407cbae88ea29a636b36f4569ec58a5a8dadca7343993ed
+          CACHE_HIT: ${{ steps.vexctl-cache.outputs.cache-hit }}
         run: |
           set -euo pipefail
+          dir="$RUNNER_TEMP/vexctl-bin"
+          mkdir -p "$dir"
           case "$RUNNER_OS" in
             Linux) asset=vexctl-linux-amd64 bin=vexctl sha="$VEXCTL_SHA256_LINUX_AMD64" ;;
             Windows) asset=vexctl-windows-amd64.exe bin=vexctl.exe sha="$VEXCTL_SHA256_WINDOWS_AMD64" ;;
             *) asset='' ;;
           esac
           if [ -n "$asset" ]; then
-            dir="$RUNNER_TEMP/vexctl-bin"
-            mkdir -p "$dir"
-            curl -fsSL --retry 5 --retry-all-errors -o "$dir/$bin" \
+            curl -fsSL --retry 5 --retry-all-errors --ssl-revoke-best-effort -o "$dir/$bin" \
               "https://github.com/openvex/vexctl/releases/download/$VEXCTL_VERSION/$asset"
             echo "$sha  $dir/$bin" | sha256sum -c -
             chmod +x "$dir/$bin"
             "$dir/$bin" version
             echo "$dir" >> "$GITHUB_PATH"
             exit 0
           fi
-          for attempt in 1 2 3 4 5; do
-            if go install "github.com/openvex/vexctl@$VEXCTL_VERSION"; then
-              break
-            fi
-            if [ "$attempt" = 5 ]; then
-              echo "::error::go install vexctl failed on all 5 attempts"
-              exit 1
-            fi
-            echo "::warning::go install vexctl attempt $attempt failed; retrying"
-            sleep $((attempt * 20))
-          done
-          echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH"
+          if [ "$CACHE_HIT" != true ]; then
+            for attempt in 1 2 3 4 5; do
+              if GOBIN="$dir" go install "github.com/openvex/vexctl@$VEXCTL_VERSION"; then
+                break
+              fi
+              if [ "$attempt" = 5 ]; then
+                echo "::error::go install vexctl failed on all 5 attempts"
+                exit 1
+              fi
+              echo "::warning::go install vexctl attempt $attempt failed; retrying"
+              sleep $((attempt * 20))
+            done
+          fi
+          "$dir/vexctl" version
+          echo "$dir" >> "$GITHUB_PATH"
+
+      - name: Save vexctl (macOS)
+        if: >-
+          runner.os == 'macOS'
+          && github.ref == 'refs/heads/main'
+          && steps.vexctl-cache.outputs.cache-hit != 'true'
+        uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
+        with:
+          path: ${{ runner.temp }}/vexctl-bin
+          key: ${{ steps.vexctl-cache.outputs.cache-primary-key }}
 
       - name: Run tests
         # Default features only: `--all-features` would also RUN the
@@ -557,13 +592,14 @@ jobs:
     # the highest base that's forward-compatible with debian:12.
     needs: docker-base
     runs-on: ubuntu-22.04
-    timeout-minutes: 30
+    # sbt's image bakes three JDKs and warm sbt / Mill / scala-cli caches.
+    timeout-minutes: ${{ matrix.ecosystem == 'sbt' && 45 || 30 }}
     permissions:
       contents: read
     strategy:
       fail-fast: false
       matrix:
-        ecosystem: [npm, pypi, gem, cargo, golang, maven, composer, nuget, deno]
+        ecosystem: [npm, pypi, gem, cargo, golang, maven, composer, nuget, deno, sbt]
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -643,18 +679,29 @@ jobs:
           # Vendor build-proof capstones ride the same image as their
           # ecosystem's main suite (extend the case as new vendor suites land).
           EXTRA=""
+          # libtest arguments after `--`.
+          FILTER=""
           case "${{ matrix.ecosystem }}" in
             composer) EXTRA="--test docker_e2e_vendor_composer" ;;
             gem)      EXTRA="--test docker_e2e_vendor_gem" ;;
             maven)    EXTRA="--test docker_e2e_vendor_maven" ;;
             nuget)    EXTRA="--test docker_e2e_vendor_nuget" ;;
             pypi)     EXTRA="--test docker_e2e_vendor_pypi_pm" ;;
+            # The blocking sbt slice: the agent cells on 1.2.8 (Ivy) and
+            # 1.13.0 (Coursier, plus the `useCoursier := false` Ivy cell).
+            # Mill, scala-cli and the other sbt lines run nightly in
+            # e2e-docker and in sbt-compatibility.yml.
+            sbt)
+              export SOCKET_PATCH_SBT_DOCKER_VERSIONS="1.2.8 1.13.0"
+              export SOCKET_PATCH_DOCKER_E2E_REQUIRED=1
+              FILTER="agent_sbt_ --test-threads=1" ;;
           esac
-          # shellcheck disable=SC2086 # EXTRA is intentionally word-split
+          # shellcheck disable=SC2086 # EXTRA and FILTER are intentionally word-split
           cargo llvm-cov \
             --features docker-e2e \
             --no-report \
-            --test docker_e2e_${{ matrix.ecosystem }} $EXTRA
+            --test docker_e2e_${{ matrix.ecosystem }} $EXTRA \
+            -- $FILTER
 
       - name: Generate per-ecosystem lcov
         run: |
@@ -1179,6 +1226,12 @@ jobs:
           - {os: ubuntu-latest, suite: 'e2e_gradle_discovery_build e2e_gradle_agent_build e2e_redirect_gradle_build', jvm_tool: gradle, gradle: '9.8.0', java: '21', test_filter: '--ignored gradle_agent_ gradle_hosted_'}
           - {os: ubuntu-latest, suite: 'e2e_vendor_gradle_build e2e_vendor_jvm_build', jvm_tool: gradle, gradle: '9.8.0', java: '21', test_filter: '--ignored gradle_vendor_ gradle_multi_project'}
           - {os: windows-latest, suite: e2e_vendor_jvm_build, jvm_tool: gradle, gradle: '8.14.3', java: '17', test_filter: '--ignored gradle_multi_project'}
+          # Real-sbt hosted (socket-patch.sbt) + vendored
+          # (socket-patch-vendor.sbt) capstones on the current 1.x line. The
+          # other sbt lines, JDK 21, the agent cells beyond coverage-docker's,
+          # Mill, scala-cli and macOS / Windows are sbt-compatibility.yml.
+          - {os: ubuntu-latest, suite: e2e_sbt_build, jvm_tool: sbt, sbt: '1.13.0', test_filter: '--ignored --test-threads=1'}
+          - {os: ubuntu-latest, suite: e2e_sbt_vendor_build, jvm_tool: sbt, sbt: '1.13.0', test_filter: '--ignored --test-threads=1'}
           # Real .NET SDK capstones: hosted + vendored nuget, one leg per SDK
           # major (the suite pins the major through a sandbox global.json):
           # the oldest and newest here, 7-9 on ubuntu in e2e-full.
@@ -1395,18 +1448,38 @@ jobs:
           distribution: temurin
           java-version: ${{ matrix.java || '17' }}
 
+      - name: Setup sbt (sbt legs)
+        if: matrix.sbt != ''
+        # The sbt launcher script; it boots whatever `sbt.version` each
+        # fixture's project/build.properties pins.
+        uses: sbt/setup-sbt@6158cb0903b8ceeae04f830055f3155e1b6a5ad7 # v1.5.11
+        with:
+          sbt-runner-version: 1.13.0
+          disk-cache: false
+
+      - name: Warm the sbt seed (sbt legs)
+        if: matrix.sbt != ''
+        # Boots the pinned sbt once into a seed the suites hard-link into
+        # each test's private caches (SOCKET_PATCH_SBT_E2E_SEED), and names
+        # the launcher (SOCKET_PATCH_SBT_E2E_SBT).
+        shell: bash
+        env:
+          SBT_TEST_VERSION: ${{ matrix.sbt }}
+        run: scripts/sbt-warm-seed.sh "$SBT_TEST_VERSION" "$RUNNER_TEMP/sbt-seed" >> "$GITHUB_ENV"
+
       - name: Install Maven ${{ matrix.maven || '3.9.16' }}
         if: steps.jvm.outputs.maven == 'true'
         # Straight from the Apache archive (sha512-verified), so a leg gets
         # exactly the release it names rather than the runner's Maven.
+        # --ssl-revoke-best-effort: see the `test` job's vexctl step.
         shell: bash
         env:
           MAVEN_VERSION: ${{ matrix.maven || '3.9.16' }}
         run: |
           major="${MAVEN_VERSION%%.*}"
           url="https://archive.apache.org/dist/maven/maven-${major}/${MAVEN_VERSION}/binaries/apache-maven-${MAVEN_VERSION}-bin.tar.gz"
-          curl -fsSL --retry 5 --retry-all-errors "$url" -o "$RUNNER_TEMP/maven.tgz"
-          curl -fsSL --retry 5 --retry-all-errors "$url.sha512" -o "$RUNNER_TEMP/maven.sha512"
+          curl -fsSL --retry 5 --retry-all-errors --ssl-revoke-best-effort "$url" -o "$RUNNER_TEMP/maven.tgz"
+          curl -fsSL --retry 5 --retry-all-errors --ssl-revoke-best-effort "$url.sha512" -o "$RUNNER_TEMP/maven.sha512"
           python -c 'import hashlib, pathlib, os; p=pathlib.Path(os.environ["RUNNER_TEMP"]); assert hashlib.sha512((p/"maven.tgz").read_bytes()).hexdigest() == (p/"maven.sha512").read_text().split()[0]'
           # Python accepts native Windows paths for both archive and destination.
           python -m tarfile -e "$RUNNER_TEMP/maven.tgz" "$RUNNER_TEMP"
@@ -1421,8 +1494,8 @@ jobs:
           GRADLE_VERSION: ${{ matrix.gradle }}
         run: |
           url="https://services.gradle.org/distributions/gradle-${GRADLE_VERSION}-bin.zip"
-          curl -fsSL --retry 5 --retry-all-errors "$url" -o "$RUNNER_TEMP/gradle.zip"
-          curl -fsSL --retry 5 --retry-all-errors "$url.sha256" -o "$RUNNER_TEMP/gradle.sha256"
+          curl -fsSL --retry 5 --retry-all-errors --ssl-revoke-best-effort "$url" -o "$RUNNER_TEMP/gradle.zip"
+          curl -fsSL --retry 5 --retry-all-errors --ssl-revoke-best-effort "$url.sha256" -o "$RUNNER_TEMP/gradle.sha256"
           python -c 'import hashlib, pathlib, os; p=pathlib.Path(os.environ["RUNNER_TEMP"]); assert hashlib.sha256((p/"gradle.zip").read_bytes()).hexdigest() == (p/"gradle.sha256").read_text().strip()'
           unzip -q "$RUNNER_TEMP/gradle.zip" -d "$RUNNER_TEMP"
           launcher="$RUNNER_TEMP/gradle-${GRADLE_VERSION}/bin/gradle"
@@ -1540,6 +1613,8 @@ jobs:
           SOCKET_PATCH_DOTNET_E2E_VERSION: ${{ matrix.dotnet }}
           SOCKET_PATCH_DENO_E2E_REQUIRED: ${{ matrix.deno != '' && '1' || '' }}
           SOCKET_PATCH_DENO_E2E_VERSION: ${{ matrix.deno }}
+          SOCKET_PATCH_SBT_E2E_REQUIRED: ${{ matrix.sbt != '' && '1' || '' }}
+          SOCKET_PATCH_SBT_E2E_VERSION: ${{ matrix.sbt }}
           E2E_SUITE: ${{ matrix.suite }}
           E2E_TEST_FILTER: ${{ matrix.test_filter || '--ignored' }}
           E2E_JVM_TOOL: ${{ matrix.jvm_tool }}
@@ -1686,13 +1761,13 @@ jobs:
     if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || github.head_ref == 'release/v5-prerelease'
     needs: docker-base
     runs-on: ubuntu-latest
-    timeout-minutes: 35
+    timeout-minutes: ${{ matrix.ecosystem == 'sbt' && 45 || 35 }}
     permissions:
       contents: read
     strategy:
       fail-fast: false
       matrix:
-        ecosystem: [npm, pypi, gem, cargo, golang, maven, composer, nuget, deno]
+        ecosystem: [npm, pypi, gem, cargo, golang, maven, composer, nuget, deno, sbt]
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -1741,13 +1816,20 @@ jobs:
         # run only in coverage-docker.
         run: |
           EXTRA=""
+          FILTER=""
           case "${{ matrix.ecosystem }}" in
             composer) EXTRA="--test docker_e2e_vendor_composer" ;;
             nuget)    EXTRA="--test docker_e2e_vendor_nuget" ;;
             pypi)     EXTRA="--test docker_e2e_vendor_pypi_pm" ;;
+            # Every sbt / Mill / scala-cli agent cell (the full sbt version
+            # x mode matrix is sbt-compatibility.yml).
+            sbt)
+              export SOCKET_PATCH_SBT_DOCKER_VERSIONS="1.2.8 1.13.0"
+              export SOCKET_PATCH_DOCKER_E2E_REQUIRED=1
+              FILTER="--test-threads=1" ;;
           esac
-          # shellcheck disable=SC2086 # EXTRA is intentionally word-split
-          cargo test -p socket-patch-cli --features docker-e2e --test "docker_e2e_${{ matrix.ecosystem }}" $EXTRA
+          # shellcheck disable=SC2086 # EXTRA and FILTER are intentionally word-split
+          cargo test -p socket-patch-cli --features docker-e2e --test "docker_e2e_${{ matrix.ecosystem }}" $EXTRA -- $FILTER
 
   # ----------------------------------------------------------------------
   # Per-release real-toolchain matrices for the manifest-less VEX work that

.github/workflows/composer-compatibility.yml

@@ -133,8 +133,12 @@ jobs:
           fi
           phar="$dir/composer-$COMPOSER_RELEASE.phar"
           base="https://getcomposer.org/download/$COMPOSER_RELEASE/composer.phar"
-          curl -fsSL --retry 5 --retry-all-errors -o "$phar" "$base"
-          published="$(curl -fsSL --retry 5 --retry-all-errors "$base.sha256sum" | cut -d' ' -f1)"
+          # --ssl-revoke-best-effort: Windows curl (schannel) otherwise fails the
+          # TLS handshake with CRYPT_E_REVOCATION_OFFLINE whenever the CA's
+          # revocation server is unreachable. A revoked certificate still fails;
+          # the body is checked against a digest right after. A no-op elsewhere.
+          curl -fsSL --retry 5 --retry-all-errors --ssl-revoke-best-effort -o "$phar" "$base"
+          published="$(curl -fsSL --retry 5 --retry-all-errors --ssl-revoke-best-effort "$base.sha256sum" | cut -d' ' -f1)"
           # shellcheck disable=SC2016 # $argv is PHP, not shell
           actual="$(php -r 'echo hash_file("sha256", $argv[1]);' "$phar")"
           if [ "$actual" != "$COMPOSER_PHAR_SHA256" ] || [ "$actual" != "$published" ]; then

.github/workflows/gradle-compatibility.yml

@@ -241,9 +241,15 @@ jobs:
         env:
           MAVEN_VERSION: '3.9.16'
         run: |
+          # --retry-all-errors: plain --retry skips refused connections and TLS
+          # handshake errors (curl exit 7/35), as in ci.yml's copy of this step.
+          # --ssl-revoke-best-effort: Windows curl (schannel) otherwise fails the
+          # TLS handshake with CRYPT_E_REVOCATION_OFFLINE whenever the CA's
+          # revocation server is unreachable. A revoked certificate still fails;
+          # the body is checked against a digest right after. A no-op elsewhere.
           url="https://archive.apache.org/dist/maven/maven-3/${MAVEN_VERSION}/binaries/apache-maven-${MAVEN_VERSION}-bin.tar.gz"
-          curl -fsSL --retry 3 "$url" -o "$RUNNER_TEMP/maven.tgz"
-          curl -fsSL --retry 3 "$url.sha512" -o "$RUNNER_TEMP/maven.sha512"
+          curl -fsSL --retry 5 --retry-all-errors --ssl-revoke-best-effort "$url" -o "$RUNNER_TEMP/maven.tgz"
+          curl -fsSL --retry 5 --retry-all-errors --ssl-revoke-best-effort "$url.sha512" -o "$RUNNER_TEMP/maven.sha512"
           python -c 'import hashlib, pathlib, os; p=pathlib.Path(os.environ["RUNNER_TEMP"]); assert hashlib.sha512((p/"maven.tgz").read_bytes()).hexdigest() == (p/"maven.sha512").read_text().split()[0]'
           python -m tarfile -e "$RUNNER_TEMP/maven.tgz" "$RUNNER_TEMP"
           launcher="$RUNNER_TEMP/apache-maven-${MAVEN_VERSION}/bin/mvn"
@@ -259,9 +265,10 @@ jobs:
         env:
           GRADLE_VERSION: ${{ matrix.gradle }}
         run: |
+          # Download flags: see the Maven step above.
           url="https://services.gradle.org/distributions/gradle-${GRADLE_VERSION}-bin.zip"
-          curl -fsSL --retry 3 "$url" -o "$RUNNER_TEMP/gradle.zip"
-          curl -fsSL --retry 3 "$url.sha256" -o "$RUNNER_TEMP/gradle.sha256"
+          curl -fsSL --retry 5 --retry-all-errors --ssl-revoke-best-effort "$url" -o "$RUNNER_TEMP/gradle.zip"
+          curl -fsSL --retry 5 --retry-all-errors --ssl-revoke-best-effort "$url.sha256" -o "$RUNNER_TEMP/gradle.sha256"
           python -c 'import hashlib, pathlib, os; p=pathlib.Path(os.environ["RUNNER_TEMP"]); assert hashlib.sha256((p/"gradle.zip").read_bytes()).hexdigest() == (p/"gradle.sha256").read_text().strip()'
           unzip -q "$RUNNER_TEMP/gradle.zip" -d "$RUNNER_TEMP"
           launcher="$RUNNER_TEMP/gradle-${GRADLE_VERSION}/bin/gradle"

.github/workflows/npm-compatibility.yml

@@ -36,6 +36,13 @@ on:
 permissions:
   contents: read
 
+# A newer push to the same PR supersedes the older run. Every other event
+# gets its own group (run_id), so no main push is cancelled, even while
+# pending behind another.
+concurrency:
+  group: npm-compat-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   build:
     runs-on: ubuntu-latest

.github/workflows/pipenv-compatibility.yml

@@ -34,6 +34,13 @@ on:
 permissions:
   contents: read
 
+# A newer push to the same PR supersedes the older run. Every other event
+# gets its own group (run_id), so no main push is cancelled, even while
+# pending behind another.
+concurrency:
+  group: pipenv-compat-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   matrix:
     strategy: