|
| 1 | +name: bughunt pipenv probe |
| 2 | + |
| 3 | +on: |
| 4 | + push: |
| 5 | + branches: ['bughunt/pipenv/**'] |
| 6 | + |
| 7 | +permissions: |
| 8 | + contents: read |
| 9 | + |
| 10 | +jobs: |
| 11 | + probe: |
| 12 | + strategy: |
| 13 | + fail-fast: false |
| 14 | + matrix: |
| 15 | + os: [ubuntu-latest, macos-latest, windows-latest] |
| 16 | + pipenv: ['2023.12.1', '2026.8.0'] |
| 17 | + runs-on: ${{ matrix.os }} |
| 18 | + timeout-minutes: 45 |
| 19 | + env: |
| 20 | + SOCKET_NO_CONFIG: '1' |
| 21 | + SOCKET_NO_UPDATE_CHECK: '1' |
| 22 | + steps: |
| 23 | + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 |
| 24 | + with: |
| 25 | + persist-credentials: false |
| 26 | + - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 |
| 27 | + with: |
| 28 | + python-version: '3.12' |
| 29 | + - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 |
| 30 | + with: |
| 31 | + key: bughunt-pipenv |
| 32 | + save-if: false |
| 33 | + - run: cargo build --locked -p socket-patch-cli |
| 34 | + - name: Install Pipenv |
| 35 | + shell: bash |
| 36 | + run: | |
| 37 | + python -m venv "$RUNNER_TEMP/pipenv-venv" |
| 38 | + if [ -x "$RUNNER_TEMP/pipenv-venv/Scripts/python.exe" ]; then PY="$RUNNER_TEMP/pipenv-venv/Scripts/python.exe"; P="$RUNNER_TEMP/pipenv-venv/Scripts/pipenv.exe"; else PY="$RUNNER_TEMP/pipenv-venv/bin/python"; P="$RUNNER_TEMP/pipenv-venv/bin/pipenv"; fi |
| 39 | + "$PY" -m pip install -q "pipenv==${{ matrix.pipenv }}" |
| 40 | + echo "PIPENV_BIN=$P" >> "$GITHUB_ENV" |
| 41 | + echo "BASE_PY=$(python -c 'import sys;print(sys.executable)')" >> "$GITHUB_ENV" |
| 42 | + - name: Probe |
| 43 | + shell: bash |
| 44 | + run: | |
| 45 | + cat > "$RUNNER_TEMP/probe.py" <<'PROBE_EOF' |
| 46 | + import base64, hashlib, io, json, os, shutil, subprocess, sys, tempfile, threading, urllib.request, zipfile |
| 47 | + from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer |
| 48 | + CLI = os.path.abspath(sys.argv[1]); PIPENV = sys.argv[2]; PY = sys.argv[3] |
| 49 | + UUID = "3c5e7a9b-1d3f-4b5d-8f7a-9b1d3f5a7c9e" |
| 50 | + WHL = "https://files.pythonhosted.org/packages/d9/5a/e7c31adbe875f2abbb91bd84cf2dc52d792b5a01506781dbcf25c91daf11/six-1.16.0-py2.py3-none-any.whl" |
| 51 | + RAW = urllib.request.urlopen(WHL).read() |
| 52 | + before = zipfile.ZipFile(io.BytesIO(RAW)).read("six.py") |
| 53 | + after = before + b"\n# SOCKET-PATCHED\nSOCKET_PATCHED = 1\n" |
| 54 | + def build(): |
| 55 | + zin = zipfile.ZipFile(io.BytesIO(RAW)); out = io.BytesIO(); zout = zipfile.ZipFile(out, "w", zipfile.ZIP_DEFLATED) |
| 56 | + rec = [n for n in zin.namelist() if n.endswith(".dist-info/RECORD")][0]; lines = [] |
| 57 | + for n in zin.namelist(): |
| 58 | + if n == rec: continue |
| 59 | + d = after if n == "six.py" else zin.read(n); zout.writestr(n, d) |
| 60 | + lines.append("%s,sha256=%s,%d" % (n, base64.urlsafe_b64encode(hashlib.sha256(d).digest()).rstrip(b"=").decode(), len(d))) |
| 61 | + lines.append(rec + ",,"); zout.writestr(rec, "\n".join(lines) + "\n"); zout.close(); return out.getvalue() |
| 62 | + g = lambda b: hashlib.sha256(b"blob %d\0" % len(b) + b).hexdigest() |
| 63 | + API_PURL = "pkg:pypi/six@1.16.0?artifact_id=py2-py3-none-any-whl" |
| 64 | + VIEW = {"uuid": UUID, "purl": API_PURL, "publishedAt": "2026-09-01T00:00:00Z", |
| 65 | + "files": {"six.py": {"beforeHash": g(before), "afterHash": g(after), "blobContent": base64.b64encode(after).decode()}}, |
| 66 | + "vulnerabilities": {"GHSA-aaaa-bbbb-cccc": {"cves": ["CVE-2026-0001"], "summary": "s", "severity": "high", "description": "d"}}, |
| 67 | + "description": "x", "license": "MIT", "tier": "free"} |
| 68 | + PATCH = {"uuid": UUID, "purl": API_PURL, "tier": "free", "cveIds": ["CVE-2026-0001"], "ghsaIds": ["GHSA-aaaa-bbbb-cccc"], "severity": "HIGH", "title": "t"} |
| 69 | + class H(BaseHTTPRequestHandler): |
| 70 | + def log_message(self, *a): pass |
| 71 | + def out(self, obj): |
| 72 | + b = json.dumps(obj).encode(); self.send_response(200); self.send_header("Content-Type", "application/json") |
| 73 | + self.send_header("Content-Length", str(len(b))); self.end_headers(); self.wfile.write(b) |
| 74 | + def do_GET(self): |
| 75 | + if "/patches/view/" in self.path: return self.out(VIEW) |
| 76 | + if self.path.startswith("/patch/pypi/"): |
| 77 | + self.send_response(200); self.send_header("Content-Length", str(len(WHEEL))); self.end_headers(); self.wfile.write(WHEEL); return |
| 78 | + if "/by-package/" in self.path: return self.out({"patches": [dict(PATCH, publishedAt="2026-09-01T00:00:00Z", description="x", license="MIT", vulnerabilities={})], "canAccessPaidPatches": False}) |
| 79 | + self.send_response(404); self.end_headers() |
| 80 | + def do_POST(self): |
| 81 | + raw = self.rfile.read(int(self.headers.get("Content-Length") or 0)).decode() |
| 82 | + if self.path.endswith("/patches/batch"): |
| 83 | + has = "pkg:pypi/six@1.16.0" in raw |
| 84 | + return self.out({"packages": [{"purl": "pkg:pypi/six@1.16.0", "patches": [PATCH]}] if has else [], "canAccessPaidPatches": False}) |
| 85 | + if self.path.endswith("/patches/package"): |
| 86 | + url = API + "/patch/pypi/six/1.16.0/11111111-2222-4333-8444-555555555555/" + UUID + "/six-1.16.0-py2.py3-none-any.whl" |
| 87 | + return self.out({"results": {UUID: {"status": "granted", "url": url, "purl": "pkg:pypi/six@1.16.0", |
| 88 | + "artifacts": [{"kind": "tarball", "url": url, "integrity": {"sha256": hashlib.sha256(WHEEL).hexdigest()}}], "registryOverride": None}}}) |
| 89 | + self.out({}) |
| 90 | + srv = ThreadingHTTPServer(("127.0.0.1", 0), H); threading.Thread(target=srv.serve_forever, daemon=True).start() |
| 91 | + API = "http://127.0.0.1:%d" % srv.server_address[1] |
| 92 | + WHEEL = build() |
| 93 | + SRC = '[[source]]\nurl = "https://pypi.org/simple"\nverify_ssl = true\nname = "pypi"\n\n' |
| 94 | + env = {k: v for k, v in os.environ.items() if not k.startswith(("PIPENV_", "VIRTUAL_ENV", "WORKON_HOME"))} |
| 95 | + env.update(PIPENV_YES="1", PIPENV_NOSPIN="1", SOCKET_API_URL=API, SOCKET_API_TOKEN="fake", SOCKET_ORG_SLUG="test-org", |
| 96 | + SOCKET_NO_CONFIG="1", SOCKET_NO_UPDATE_CHECK="1", SOCKET_TELEMETRY_DISABLED="1") |
| 97 | + ver = subprocess.run([PIPENV, "--version"], capture_output=True, text=True).stdout.strip() |
| 98 | + base = os.path.realpath(os.path.join(os.environ.get("RUNNER_TEMP", tempfile.gettempdir()), "bh")) |
| 99 | + os.makedirs(base, exist_ok=True) |
| 100 | + rows = [] |
| 101 | + def run(args, d, e): |
| 102 | + return subprocess.run(args, cwd=d, env=e, capture_output=True, text=True) |
| 103 | + def six_state(d, e): |
| 104 | + r = run([PIPENV, "run", "python", "-c", "import six;print(six.__file__, 'PATCHED' if hasattr(six,'SOCKET_PATCHED') else 'UNPATCHED')"], d, e) |
| 105 | + return r.stdout.strip() or r.stderr.strip()[-200:] |
| 106 | + def j(s): |
| 107 | + try: return json.loads(s.stdout[s.stdout.find("{"):]) |
| 108 | + except Exception: return {"nojson": (s.stdout + s.stderr)[-400:]} |
| 109 | + other = os.path.join(base, "other-venv") |
| 110 | + run([PY, "-m", "venv", other], base, env) |
| 111 | + opy = os.path.join(other, "Scripts", "python.exe") if os.name == "nt" else os.path.join(other, "bin", "python") |
| 112 | + run([opy, "-m", "pip", "install", "-q", "six==1.16.0"], base, env) |
| 113 | + def other_state(): |
| 114 | + r = run([opy, "-c", "import six;print('PATCHED' if hasattr(six,'SOCKET_PATCHED') else 'UNPATCHED')"], base, env) |
| 115 | + return "other=" + (r.stdout.strip() or r.stderr.strip()[-120:]) |
| 116 | + for case in ("no-virtualenv", "virtualenv-default", "virtualenv+IGNORE_VIRTUALENVS=1", "virtualenv+PIPENV_ACTIVE=1"): |
| 117 | + run([opy, "-m", "pip", "install", "-q", "--force-reinstall", "--no-deps", "six==1.16.0"], base, env) |
| 118 | + d = os.path.join(base, case.replace("+", "_").replace("=", "")); os.makedirs(d) |
| 119 | + open(os.path.join(d, "Pipfile"), "w").write(SRC + '[packages]\nsix = "==1.16.0"\n') |
| 120 | + e = dict(env) |
| 121 | + inst = run([PIPENV, "install", "--python", PY], d, dict(env, PIPENV_IGNORE_VIRTUALENVS="1")) |
| 122 | + if case != "no-virtualenv": |
| 123 | + e["VIRTUAL_ENV"] = other |
| 124 | + if "IGNORE" in case: e["PIPENV_IGNORE_VIRTUALENVS"] = "1" |
| 125 | + if "ACTIVE" in case: e["PIPENV_ACTIVE"] = "1" |
| 126 | + venv = run([PIPENV, "--venv"], d, e).stdout.strip() |
| 127 | + s = run([CLI, "scan", "--mode", "agent", "--json", "--yes"], d, e); o = j(s) |
| 128 | + acts = [(p.get("action"), p.get("errorCode")) for p in o.get("apply", {}).get("patches", [])] |
| 129 | + rows.append((case, "install=%d" % inst.returncode, "scan exit=%d status=%s %s" % (s.returncode, o.get("status"), acts), "pipenv --venv=" + venv, "pipenv run: " + six_state(d, e), other_state())) |
| 130 | + print("== %s | %s | base=%s" % (ver, sys.platform, base)) |
| 131 | + for row in rows: print(" | ".join(row)) |
| 132 | + PROBE_EOF |
| 133 | + CLI="$PWD/target/debug/socket-patch"; [ -f "$CLI.exe" ] && CLI="$CLI.exe" |
| 134 | + python "$RUNNER_TEMP/probe.py" "$CLI" "$PIPENV_BIN" "$BASE_PY" |
0 commit comments