Repository navigation
Fix Go patch delivery, audits, and reinstalls - #1698
Mikola Lysenko (mikolalysenko) wants to merge 3 commits into
Conversation
Verify the native vendor tree selected by Go before attesting patches. Account for workspaces, GOFLAGS, selected packages, embedded assets, and dependency-only fixes. Forward consumer synchronization warnings through nested agent get operations. Preserve upstream checksum lines with local patch artifacts and restore them on rollback after tidy. Refuse checksum conflicts without removing an active replacement or its copy, including orphan reconciliation. Replace empty production Go canaries with pgx/v5 execution proofs for hosted, vendored, and agent delivery, fresh caches, cold agent failure and recovery, and rollback. Add real Go regressions for native drift and the lifecycle failures reproduced by the smoke repository. Assisted-by: Codex:GPT-6
Reuse verified project-local agent copies after clearing the Go module cache. Refuse corrupted copies without an upstream rebuild source. Exercise get, scan, dependency maintenance, repeated native vendoring, and workspace synchronization with the patched pgx decoder. Assisted-by: Codex:gpt-6-astra
Mikola Lysenko (mikolalysenko)
changed the title
|
Burn-down agent: draft CI is green on Question for a human: once depscan#28901 is deployed and the pgx Generated by Claude Code |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using high effort and found 3 potential issues.
Bugbot Autofix is ON, but none of the reported issues met your autofix severity threshold.
Comment @cursor review or bugbot run to trigger another review on this PR
Reviewed by Cursor Bugbot for commit 5c40667. Configure here.
| } | ||
|
|
||
| removed | ||
| Ok(removed) |
There was a problem hiding this comment.
Teardown leaves dangling Go replace
Medium Severity
Failed redirect teardown deletes the patched copy first, then calls drop_replace_entry, which now restores checksums and aborts on conflict before removing the replace. That error is ignored, so go.mod can keep pointing at a directory that no longer exists and every subsequent go build fails.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit 5c40667. Configure here.
| } | ||
| } | ||
| } | ||
| } |
There was a problem hiding this comment.
Backup merges conflicting checksum lines
Medium Severity
save unions live go.sum lines with an existing .upstream-go.sum via reinsert_lines, which treats different h1 values as distinct lines. A later rollback after go mod tidy can write both hashes back, producing an invalid go.sum instead of refusing the conflict.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit 5c40667. Configure here.
| let mut parts = version.split('.'); | ||
| let major = parts.next()?.parse::<u64>().ok()?; | ||
| let minor = parts.next()?.parse::<u64>().ok()?; | ||
| (major > 1 || major == 1 && minor >= 14).then_some(dir) |
There was a problem hiding this comment.
RC go lines skip vendor audit
Low Severity
native_vendor_dir parses the go directive with u64 on each dotted field. A valid line such as go 1.21rc1 fails that parse, so the function returns None and VEX plus --check skip native vendor/ verification while Go still auto-selects that tree.
Reviewed by Cursor Bugbot for commit 5c40667. Configure here.
Pull request was converted to draft
Resolve conflicts with main's advisory-warning refactor (#1722) and the global Go tool tests (#1717). apply.rs keeps main's advisory_warning_codes loop (it covers ownership_not_restored too) and drops main's nested_skip_warnings, because this branch already reports those skips through run_warnings. e2e_golang_build.rs keeps both sides' new tests. Co-Authored-By: Claude <noreply@anthropic.com>
|
Burn-down agent: merged
Draft hold and Generated by Claude Code |
The pgx/v5 smoke test exposed local Go patches that could be attested while Go built vulnerable bytes from native
vendor/, a missing warning in agentget, and rollback that stopped building aftergo mod tidyremoved upstream checksums. Reapplying an intact agent patch after deleting the module cache also failed withpackage_not_installed. The production Go canaries passed without proving delivery.Changes
apply --check/vendor --check. Cover workspace markers, quoted and double-hyphen GOFLAGS, unused replacements, package selection, ignored files, embedded assets, and dependency-only patches.github.com/jackc/pgx/v5@v5.7.0patchd8941a4c-4bcd-4756-b0aa-239ec9c81b0f: require a delivery event and reject the malformed decoder input without a panic. Exercise get/scan, fresh caches, cache removal, same-versiongo get,go mod download/tidy/verify, consumer tests, repeated native vendoring, offline rollback after tidy, and explicit cold-cache agent failure followed by recovery. Hosted/vendored workspace tests also exercisego work syncandgo work vendorwhen supported.The cold-cache false
appliedresult from the older smoke-test revision was already fixed on current main; this PR adds a live regression guard for the corrected failure behavior.Validation
5c4066702(32 settled checks). Heavy draft-gated jobs were validated locally. Two high-effort Codex CLI reviews were run; confirmed findings were fixed and given regression coverage.Rollout dependency
Companion backend PR: https://github.com/SocketDev/depscan/pull/28901
Keep this PR in draft until the backend is deployed and the existing legacy pgx patch is regenerated through the existing package-reset/admin workflow. The strict production hosted canary currently fails with
redirect_golang_unsupported, because production has not published that patch's/v5hosted module. It must pass before this PR is ready to merge; do not replace it with an empty-consumer success.No production deployment or patch regeneration was performed. Existing checkouts created by older CLI releases without a checksum backup may still need
go mod download <module>@<version>after rollback; newly patched checkouts restore their saved checksums offline.Note
High Risk
Changes attestation and CI audit paths for Go patches plus offline rollback/checksum handling; incorrect vendor or sum logic could false-pass or false-fail security verification.
Overview
Go local patches now treat native
vendor/as part of the security boundary: when Go would build from vendored modules,apply --check,vendor --check, and VEX compare that tree to the manifest (including workspace trees,GOFLAGS -mod=, embeds, build constraints, and dependency-only patches) and fail withgo_vendor_content_mismatchif runtime bytes drift.Agent apply can reuse an existing
.socket/go-patches/copy when the module cache is empty, after validating hashes andreplacewiring; corrupt copies fail without deleting the tree. Upstreamgo.sumlines are stored in.upstream-go.sumbeside the patch copy, restored on rollback, and checksum conflicts block rollback/reconcile without dropping the active replacement.Production e2e canaries swap empty Go stubs for a real pgx/v5 v5.7.0 delivery proof (get/scan, native vendor, cold-cache agent, reinstall/tidy/rollback). Docs describe reinstall behavior, checksum backups, and native vendor audits.
Reviewed by Cursor Bugbot for commit 5c40667. Configure here.
Generated by Claude Code