Fix #258: state the real Maven Trusted Checksums floor by mikolalysenko · Pull Request #322 · SocketDev/socket-patch

Mikola Lysenko (mikolalysenko) · 2026-09-30T14:27:23Z

LLM Description written by Claude Code:claude-opus-5-5

Fixes #258

Summary

Hosted Maven mode writes a Trusted Checksums pin (.mvn/maven.config and .mvn/checksums/checksums.sha256). Maven 3.9.0 to 3.9.3 never enforce it. The docs, the 4.0.0 notes and the e2e test gate all said every 3.9 release does. On those releases, a Socket-served jar re-signed with a matching .sha1 installs without error.

CLI: when .mvn/wrapper/maven-wrapper.properties pins a Maven older than 3.9.4 and the Socket pin is in place, scan --mode hosted warns redirect_maven_trusted_checksums_unenforced, with an upgrade hint. That covers both a run that writes the pin and a re-scan of a project that was already pinned. The CLI still writes the pin: a wrapper upgrade makes it effective, and the version suffix still fails closed. The wrapper file is only read, never edited: it is a HOSTED | PRESENCE_ONLY maven row in the v5 format registry (crates/socket-patch-core/src/formats/registry.rs). Without a wrapper there's no reliable way to know the project's Maven, so the CLI stays silent and the docs state the floor.
Test gate: Mvn::enforces_trusted_checksums now starts at 3.9.4.
E2E: the real-Maven hosted capstone pins the Maven under test through the wrapper. It asserts that the new warning appears exactly when step 5b, the re-signed-jar tamper test, shows the pin is ignored.
CI: new e2e_redirect_maven_build legs on 3.9.3 (last release that ignores the pin) and 3.9.4 (first that enforces it).
Docs: docs/ecosystems.md, the CLI_CONTRACT and a CHANGELOG Fixed entry now state the real floor and the reason for each version range.

Root cause

The resolver features the config relies on arrived in stages:

3.9.0 / 3.9.1: ${session.rootDirectory} in maven.config is not interpolated, so the summary file is never found.
3.9.2 / 3.9.3: checksumAlgorithms=SHA-256 is ignored and only SHA-1 is checked.
3.9.4: first release that rejects a mismatch.

The gate and docs assumed all of 3.9 enforced, and CI only ran 3.9.16.

Out of scope: writing a checksums.sha1 summary, the issue's optional item 4. Hosted mode has no SHA-1 for the patched jar or pom, since the serve route supplies only sha256. Even with one, 3.9.0/3.9.1 would still fail on ${session.rootDirectory}.

Merge with v5 (#277)

main gained the v5 workflow after this PR was green. 18ff786 merges it in as a merge commit; nothing was rebased or force-pushed. Two conflicts:

scan/hosted.rs: v5 builds the hosted read list from the format registry, so the wrapper file moved there. The by-value pin test redirect_candidates_are_pinned_by_value now lists it.
CHANGELOG.md: the entry is rewritten in v5's short style.

Test evidence

Red: before the warning was wired in, cargo test -p socket-patch-core --all-features --lib -- maven_pom_trusted_checksums maven_wrapper_version gave 3 passed and 1 failed. maven_pom_trusted_checksums_warns_when_the_wrapper_maven_ignores_them failed with 3.9.0: [].
Re-scan (Bugbot finding): maven_pom_trusted_checksums_unenforced_warning_survives_a_rescan fails on aedb117 (warnings []) and passes on c6b068d.
On the merge (18ff786):
- 15 maven_pom* / maven_wrapper* / formats::registry core tests pass.
- All 826 CLI lib tests pass.
- hosted_memory_engine, hosted_memory_parity, in_process_get_hosted_ecosystems and e2e_maven pass.
- Clippy, the CI command, is clean.
- The real-Maven e2e_redirect_maven_build passes on 3.9.3 (warning present; re-signed jar accepted) and on 3.9.4 (no warning; trusted-checksums rejection).
- In the full core lib suite, 4642 pass and 4 fail; all 4 are permission tests that fail only as root and pass as nobody.
Red check: on 3.9.3 the old gate (>= 3.9) fails the same e2e.
Before the merge: CI on c6b068d was green (all 248 jobs, including the 3.9.3 and 3.9.4 legs), the compatibility workflows passed, and Bugbot was clean.
CI on 18ff786: green, and Bugbot is clean. Two jobs needed one re-run each, for failures that aren't in this PR's code:
- PDM compatibility, cell space-unicode agent.
- test-release, an ETXTBSY race in the vlt harness test vlt_e2e_harness_npx_shim_forwards_the_args_after_the_package. A retry for it is proposed in the PR comments.

🤖 Generated with Claude Code

https://claude.ai/code/session_01SKHTWrnMW6VVJm1gnMnYdz

Generated by Claude Code

Assisted-by: Claude Code:claude-opus-5-5

Hosted Maven writes a Trusted Checksums pin under .mvn/, but Maven 3.9.0-3.9.3 and every older line never enforce it. A re-signed jar with a matching .sha1 then installs without error. When .mvn/wrapper/maven-wrapper.properties pins such a release, scan now warns redirect_maven_trusted_checksums_unenforced. It still writes the pin, and the version suffix still fails closed. Refs #258. Assisted-by: Claude Code:claude-opus-5-5

The real-Maven hosted capstone treated every 3.9 release as enforcing the .mvn/checksums pin, but enforcement starts at 3.9.4. Fix the gate, pin the Maven under test through the wrapper so the capstone also checks the new warning, and add CI legs on 3.9.3 and 3.9.4. Refs #258. Assisted-by: Claude Code:claude-opus-5-5

The docs and 4.0.0 notes said Maven 3.9+ enforces the hosted pin. State the 3.9.4 floor, why 3.9.0-3.9.3 ignore it, and the new redirect_maven_trusted_checksums_unenforced warning. Refs #258. Assisted-by: Claude Code:claude-opus-5-5

Mikola Lysenko (mikolalysenko) · 2026-09-30T15:05:51Z

BugBot review

Generated by Claude Code

Mikola Lysenko (mikolalysenko) · 2026-09-30T15:10:31Z

[agent] CI note. PDM patch compatibility / native (ubuntu-latest, 2.29.2) failed once on aedb117. Only one cell was red: multi-target hosted, check rescanAfterRelockApplies, 43 s against about 20 s for its neighbours. That cell drives the production patch API, and this PR only changes Maven code and the read-only Maven wrapper file. I re-ran the failed jobs once and the same job passed on the same commit (attempt 2). The macOS jobs in the PDM and Composer runs were cancelled before they got a runner, so the same re-run covered them. I couldn't reproduce the cell locally because the sandbox can't reach patches-api.socket.dev. If it goes red again, it needs a real look at the PDM relock path.

Generated by Claude Code

cursor

Stale Bugbot comment from a previous run.

The unenforced-pin warning fired only on the run that wrote the .mvn/checksums pin. Re-scanning a project that was already pinned stayed silent, even though the wrapper's Maven still ignores the pin. Now the warning depends on whether the Socket pin is in place after the run, not on whether this run wrote it. Refs #258. Assisted-by: Claude Code:claude-opus-5-5

Mikola Lysenko (mikolalysenko) · 2026-09-30T15:20:54Z

BugBot review

Generated by Claude Code

Mikola Lysenko (mikolalysenko) · 2026-09-30T15:26:03Z

[agent] CI note for c6b068d. Poetry patch compatibility / native (ubuntu-latest, 1.1.15) failed in one cell: direct agent, checks rollbackExit0, rollbackRestoresUpstreamBytes and rollbackClearsManifest. The other six cells passed. The same workflow was green on aedb117. The only change since then is c6b068d, which moves where the Maven hosted rewriter emits its warning. Agent-mode apply and rollback for PyPI don't call that code. I can't read the result artifact or reproduce the case here, because the sandbox can't reach the Actions artifact store or patches-api.socket.dev. I re-ran the failed job once. If it fails again, I'll treat it as real and dig into the Poetry 1.1.15 agent rollback path.

Generated by Claude Code

cursor

Stale Bugbot comment from a previous run.

main now builds the hosted read list from the format registry, so the Maven wrapper file moves there as a read-only maven row. The pinned candidate-list test lists it too. The CHANGELOG entry is rewritten in v5's short style. Assisted-by: Claude Code:claude-opus-5-5

Mikola Lysenko (mikolalysenko) · 2026-10-01T01:25:16Z

BugBot review

Generated by Claude Code

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 18ff786. Configure here.}

Mikola Lysenko (mikolalysenko) · 2026-10-01T01:34:43Z

On merge commit 18ff786, PDM patch compatibility / native (ubuntu-latest, 2.9.3) failed in one cell: space-unicode agent → appliedExactlyOne. The other 35 cells of that job passed.

As far as I can tell this failure isn't caused by this PR:

The merge adds only Maven code: a Maven warning, one registry row for .mvn/wrapper/maven-wrapper.properties and a pinned-list test. Nothing on the PyPI, PDM or agent-mode paths changed.
space-unicode agent passed on all 15 other PDM versions in this run. It also passed on 2.9.3 in main's run on 2463257, and on this PR's previous head (c6b068d).
I couldn't see the cell's cli-output.json. My sandbox can't download the artifact or reach the patches API, so I couldn't reproduce it here either.

I don't know of an existing fix. I've re-run the failed job once. If it fails again, I'll treat it as real and investigate.

Generated by Claude Code

Mikola Lysenko (mikolalysenko) · 2026-10-01T01:47:31Z

On 18ff786, test-release failed in e2e_vlt. The test vlt_e2e_common::vlt_e2e_harness_npx_shim_forwards_the_args_after_the_package panicked at tests/vlt_e2e_common/mod.rs:2538 with Os { code: 26, kind: ExecutableFileBusy, message: "Text file busy" }.

I don't think this PR caused it. The test writes an npx shim and runs it straight away. Meanwhile other test threads are forking, and one of them can briefly inherit the shim's still-open write handle. Linux won't run a file while a write handle to it is open, so the exec fails with "Text file busy". The harness came in with v5 (#277), and this PR doesn't touch vlt or the test harness.

I tried to re-run the failed job, but GitHub refused while other jobs in that run were still going. I'll re-run it once when the run finishes. If it fails again, I'll push the retry below, since it only changes the test.

No fix exists yet. The repo already handles this race in tests/common/update_fixture.rs (exec_freshly_written). The same retry would make this spawn robust:

let out = {
    let deadline = std::time::Instant::now() + std::time::Duration::from_secs(10);
    loop {
        match Command::new(&npx)
            .args(["-y", "@socketsecurity/socket-patch", "apply", "--silent", "--ecosystems", "npm"])
            .output()
        {
            Ok(out) => break out,
            Err(e) if e.raw_os_error() == Some(26) && std::time::Instant::now() < deadline => {
                std::thread::sleep(std::time::Duration::from_millis(20));
            }
            Err(e) => panic!("spawn the npx shim: {e:?}"),
        }
    }
};

Generated by Claude Code

Mikola Lysenko (mikolalysenko) · 2026-10-01T03:10:56Z

[burn-down agent] Ready for review on 18ff786: mergeable with current main (post-#277), CI all green (no failures; only path-filtered skips), Cursor Bugbot reviewed 18ff786 with no new issues, no unresolved review threads. Labeled Ready for review.

Generated by Claude Code

Start fix for #258

a670bec

Assisted-by: Claude Code:claude-opus-5-5

Mikola Lysenko (mikolalysenko) mentioned this pull request Sep 30, 2026

Hosted Maven Trusted Checksums are silently inert on Maven 3.9.0–3.9.3 (docs and the test gate claim ≥3.9 enforces) #258

Open

Claude (claude) added 3 commits September 30, 2026 14:35

Document the real Maven trusted-checksum floor

aedb117

The docs and 4.0.0 notes said Maven 3.9+ enforces the hosted pin. State the 3.9.4 floor, why 3.9.0-3.9.3 ignore it, and the new redirect_maven_trusted_checksums_unenforced warning. Refs #258. Assisted-by: Claude Code:claude-opus-5-5

Mikola Lysenko (mikolalysenko) marked this pull request as ready for review September 30, 2026 15:05

cursor Bot reviewed Sep 30, 2026

View reviewed changes

Comment thread crates/socket-patch-core/src/patch/redirect/mod.rs Outdated

cursor Bot reviewed Sep 30, 2026

View reviewed changes

cursor Bot reviewed Oct 1, 2026

View reviewed changes

Mikola Lysenko (mikolalysenko) added the Ready for review Agent-verified: mergeable, CI green, Bugbot clean — awaiting human review label Oct 1, 2026

Mikola Lysenko (mikolalysenko) enabled auto-merge (squash) October 1, 2026 03:15

Navigation Menu

Fix #258: state the real Maven Trusted Checksums floor - #322

Fix #258: state the real Maven Trusted Checksums floor#322
Mikola Lysenko (mikolalysenko) wants to merge 6 commits into
mainfrom
agent/issue-258-maven-trusted-checksum-floor

Mikola Lysenko (mikolalysenko) commented Sep 30, 2026 •

edited

Loading

Uh oh!

Mikola Lysenko (mikolalysenko) commented Sep 30, 2026

Uh oh!

Mikola Lysenko (mikolalysenko) commented Sep 30, 2026

Uh oh!

cursor Bot left a comment •

edited

Loading

Uh oh!

Uh oh!

Mikola Lysenko (mikolalysenko) commented Sep 30, 2026

Uh oh!

Mikola Lysenko (mikolalysenko) commented Sep 30, 2026

Uh oh!

cursor Bot left a comment •

edited

Loading

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 1, 2026

Uh oh!

cursor Bot left a comment

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 1, 2026

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 1, 2026 •

edited

Loading

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 1, 2026 •

edited

Loading

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

Mikola Lysenko (mikolalysenko) commented Sep 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

LLM Description written by Claude Code:claude-opus-5-5

Summary

Root cause

Merge with v5 (#277)

Test evidence

Uh oh!

Mikola Lysenko (mikolalysenko) commented Sep 30, 2026

Uh oh!

Mikola Lysenko (mikolalysenko) commented Sep 30, 2026

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Mikola Lysenko (mikolalysenko) commented Sep 30, 2026

Uh oh!

Mikola Lysenko (mikolalysenko) commented Sep 30, 2026

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 1, 2026

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 1, 2026

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Mikola Lysenko (mikolalysenko) commented Sep 30, 2026 •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

Mikola Lysenko (mikolalysenko) commented Oct 1, 2026 •

edited

Loading

Mikola Lysenko (mikolalysenko) commented Oct 1, 2026 •

edited

Loading