bughunt go probe: windows apply

Author: claude

.github/workflows/bughunt-go.yml

@@ -0,0 +1,83 @@
+name: bughunt go probe
+on:
+  push:
+    branches: ['bughunt/go/**']
+permissions:
+  contents: read
+jobs:
+  probe:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [windows-latest, windows-2022, ubuntu-latest]
+        go: ['1.21.13', '1.26.3']
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 45
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        with:
+          go-version: ${{ matrix.go }}
+          cache: false
+      - run: cargo build --release -p socket-patch-cli
+      - name: probe
+        run: |
+          cat > "$RUNNER_TEMP/probe.sh" <<'PROBE'
+          # Portable (Linux/macOS/Windows git-bash) repro for two Go findings.
+          set -u
+          SP="$1"; ROOT="$2"; rm -rf "$ROOT"; mkdir -p "$ROOT"
+          PY=$(command -v python3 || command -v python)
+          mp() { if command -v cygpath >/dev/null 2>&1; then cygpath -m "$1"; else echo "$1"; fi; }
+          furl() { local p; p=$(mp "$1"); case "$p" in /*) echo "file://$p";; *) echo "file:///$p";; esac; }
+          export GOTOOLCHAIN=local GOSUMDB=off GOENV=off GOFLAGS= SOCKET_NO_CONFIG=1 SOCKET_NO_UPDATE_CHECK=1
+          stage() {
+            T="$1"; M=example.com/upstream; V=v1.0.0
+            mkdir -p "$T/stage/$M@$V" "$T/modcache" "$T/gocache" "$T/proxy/$M/@v" "$T/c/.socket/blobs"
+            printf 'module %s\n\ngo 1.16\n' $M > "$T/stage/$M@$V/go.mod"
+            printf 'package upstream\n\nfunc Greeting() string { return "PRISTINE" }\n' > "$T/stage/$M@$V/lib.go"
+            printf 'package upstream\n\nfunc Greeting() string { return "PATCHED" }\n' > "$T/patched.go"
+            echo "{\"Version\":\"$V\"}" > "$T/proxy/$M/@v/$V.info"; cp "$T/stage/$M@$V/go.mod" "$T/proxy/$M/@v/$V.mod"
+            "$PY" - "$T" "$M@$V" <<'P'
+          import sys,zipfile,os
+          t,pre=sys.argv[1],sys.argv[2]
+          src=os.path.join(t,'stage',pre); z=zipfile.ZipFile(os.path.join(t,'proxy','example.com','upstream','@v','v1.0.0.zip'),'w')
+          for f in ('go.mod','lib.go'): z.write(os.path.join(src,f),pre+'/'+f)
+          z.close()
+          import hashlib
+          def g(p):
+            d=open(p,'rb').read(); return hashlib.sha256(b'blob %d\0'%len(d)+d).hexdigest()
+          b=g(os.path.join(src,'lib.go')); a=g(os.path.join(t,'patched.go'))
+          import shutil; shutil.copy(os.path.join(t,'patched.go'),os.path.join(t,'c','.socket','blobs',a))
+          open(os.path.join(t,'c','.socket','manifest.json'),'w').write('{"patches":{"pkg:golang/example.com/upstream@v1.0.0":{"uuid":"4d5e6f70-8192-4a1b-8c2d-0123456789ab","exportedAt":"t","files":{"lib.go":{"beforeHash":"%s","afterHash":"%s"}},"vulnerabilities":{"GHSA-gogo-patc-hes1":{"cves":["CVE-2026-5151"],"summary":"s","severity":"high","description":"d"}},"description":"","license":"","tier":""}},"setup":{"manual":["golang"]}}'%(b,a))
+          P
+            export GOMODCACHE=$(mp "$T/modcache") GOCACHE=$(mp "$T/gocache") GOPROXY=$(furl "$T/proxy")
+            printf 'module example.com/consumer\n\ngo 1.16\n\nrequire %s %s\n' $M $V > "$T/c/go.mod"
+            printf 'package main\n\nimport (\n\t"fmt"\n\t"%s"\n)\n\nfunc main() { fmt.Println("OUT:", upstream.Greeting()) }\n' $M > "$T/c/main.go"
+            (cd "$T/c" && go mod download $M@$V && go mod tidy) || echo "STAGE FAILED"
+          }
+          res() { echo "RESULT $1: $2"; }
+          
+          
+          echo "################ W. plain apply / vendor (no vendor/ dir)"
+          for mode in ro rw; do
+          for cmd in apply vendor; do
+            T="$ROOT/w-$cmd-$mode"; if [ $mode = rw ]; then export GOFLAGS=-modcacherw; else export GOFLAGS=; fi
+            stage "$T"; cd "$T/c"; export GOFLAGS=
+            ls -l "$(mp "$T/modcache")/example.com/upstream@v1.0.0/" 2>&1 | head -4
+            if command -v attrib >/dev/null 2>&1; then attrib "$(cygpath -w "$T/modcache/example.com/upstream@v1.0.0/lib.go")"; fi
+            RUST_BACKTRACE=1 "$SP" $cmd --offline --ecosystems golang --json > out.json 2>err.txt; ec=$?
+            echo "--- $cmd/$mode json:"; head -c 1500 out.json; echo; head -20 err.txt
+            out=$(go run . 2>&1 | tail -1)
+            res "W-$cmd-$mode" "exit=$ec run=[$out] $(grep -o '"error":"[^"]*' out.json | head -1)"
+            ls -la .socket/go-patches/example.com 2>/dev/null | head -3
+          done; done
+          PROBE
+          go version
+          SP="$PWD/target/release/socket-patch"; [ -f "$SP.exe" ] && SP="$SP.exe"
+          bash "$RUNNER_TEMP/probe.sh" "$SP" "$RUNNER_TEMP/bh" 2>&1 | tee "$RUNNER_TEMP/log.txt"
+          echo "=========== SUMMARY"; grep RESULT "$RUNNER_TEMP/log.txt"