From d31cbb9bbad6283f429fb52530b310f38d9d153e Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 12 Oct 2026 01:55:36 +0000 Subject: [PATCH 1/3] Start fix for #824 (slice 5) Assisted-by: Claude Code:claude-opus-5-5 From 11248fdae2a456c237c499de7bd916a7cea6009c Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 12 Oct 2026 02:04:17 +0000 Subject: [PATCH 2/3] Share test helpers in repair and scan tests Four repair/ and scan/ test files still kept their own copies of the binary() and git_sha256 helpers, held back while #1398 changed them. That PR has merged, so they now use the shared ones in tests/common, and the helper-copy ratchet drops them from its pending list so a new copy there fails the test. Only the four shared *_common modules stay pending. Refs #824 Assisted-by: Claude Code:claude-opus-5-5 --- .../tests/cli/shared_helper_copies.rs | 7 +------ .../tests/repair/covgap_commands_repair.rs | 16 +--------------- .../repair/covgap_commands_repair_vendor.rs | 16 ++-------------- .../tests/repair/repair_invariants.rs | 16 +--------------- .../tests/scan/covgap_commands_fetch_stage.rs | 19 ++----------------- 5 files changed, 7 insertions(+), 67 deletions(-) diff --git a/crates/socket-patch-cli/tests/cli/shared_helper_copies.rs b/crates/socket-patch-cli/tests/cli/shared_helper_copies.rs index c81db3c5d..17e4aa097 100644 --- a/crates/socket-patch-cli/tests/cli/shared_helper_copies.rs +++ b/crates/socket-patch-cli/tests/cli/shared_helper_copies.rs @@ -9,15 +9,10 @@ use std::path::Path; /// Files that still define a private `binary()` or `git_sha256`. Each is -/// changed by an open PR, or is a shared module whose includers don't all -/// declare `mod common`. Migrate a file onto `common` and delete its entry; +/// a shared module whose includers don't all declare `mod common`. Migrate a file onto `common` and delete its entry; /// a stale entry is not an error, so a PR that migrates one never turns /// another red. const PENDING_PRIVATE_HELPERS: &[&str] = &[ - "repair/covgap_commands_repair.rs", - "repair/covgap_commands_repair_vendor.rs", - "repair/repair_invariants.rs", - "scan/covgap_commands_fetch_stage.rs", "vex_e2e_common/mod.rs", "vlt_e2e_common/mod.rs", "vlt_hosted_common/mod.rs", diff --git a/crates/socket-patch-cli/tests/repair/covgap_commands_repair.rs b/crates/socket-patch-cli/tests/repair/covgap_commands_repair.rs index 8030a5f17..200321737 100644 --- a/crates/socket-patch-cli/tests/repair/covgap_commands_repair.rs +++ b/crates/socket-patch-cli/tests/repair/covgap_commands_repair.rs @@ -23,18 +23,13 @@ use std::path::{Path, PathBuf}; use std::process::Command; -use crate::common::hermetic_command; +use crate::common::{binary, git_sha256, hermetic_command}; -use sha2::{Digest, Sha256}; use wiremock::matchers::{method, path}; use wiremock::{Mock, MockServer, ResponseTemplate}; const ORG_SLUG: &str = "test-org"; -fn binary() -> PathBuf { - env!("CARGO_BIN_EXE_socket-patch").into() -} - /// A `socket-patch` command rooted at `cwd` with every ambient `SOCKET_*` /// env var scrubbed by `hermetic_command` (same rationale as `repair_invariants.rs`: an ambient /// `SOCKET_OFFLINE`/`SOCKET_JSON`/`SOCKET_SILENT` would flip the very @@ -46,15 +41,6 @@ fn socket_cmd(cwd: &Path) -> Command { cmd } -/// Git-SHA256: SHA256("blob \0" ++ content). -fn git_sha256(content: &[u8]) -> String { - let header = format!("blob {}\0", content.len()); - let mut hasher = Sha256::new(); - hasher.update(header.as_bytes()); - hasher.update(content); - hex::encode(hasher.finalize()) -} - /// A manifest with one patch referencing one blob — the baseline /// `.socket/manifest.json` (mirrors `repair_invariants.rs`). const MANIFEST_JSON: &str = r#"{ diff --git a/crates/socket-patch-cli/tests/repair/covgap_commands_repair_vendor.rs b/crates/socket-patch-cli/tests/repair/covgap_commands_repair_vendor.rs index dbc946b8e..0d100f5c5 100644 --- a/crates/socket-patch-cli/tests/repair/covgap_commands_repair_vendor.rs +++ b/crates/socket-patch-cli/tests/repair/covgap_commands_repair_vendor.rs @@ -15,16 +15,12 @@ use std::path::{Path, PathBuf}; -use crate::common::hermetic_command; +use crate::common::{binary, git_sha256, hermetic_command}; -use sha2::{Digest, Sha256}; +use sha2::Digest; use wiremock::matchers::{method, path}; use wiremock::{Mock, MockServer, ResponseTemplate}; -fn binary() -> PathBuf { - env!("CARGO_BIN_EXE_socket-patch").into() -} - const ORG_SLUG: &str = "test-org"; const UUID: &str = "11111111-1111-4111-8111-111111111111"; const PURL: &str = "pkg:npm/left-pad@1.3.0"; @@ -43,14 +39,6 @@ const GEM_PURL_QUALIFIED: &str = "pkg:gem/padlock@1.2.0?platform=ruby"; const GEM_ENCODED: &str = "pkg%3Agem%2Fpadlock%401.2.0"; const GEMSPEC_STUB: &[u8] = b"Gem::Specification.new do |s|\n s.name = \"padlock\"\n s.version = \"1.2.0\"\n s.summary = \"repair fixture\"\n s.authors = [\"socket-patch e2e\"]\n s.require_paths = [\"lib\"]\nend\n"; -fn git_sha256(content: &[u8]) -> String { - let header = format!("blob {}\0", content.len()); - let mut hasher = Sha256::new(); - hasher.update(header.as_bytes()); - hasher.update(content); - hex::encode(hasher.finalize()) -} - fn sri_of(bytes: &[u8]) -> String { use base64::Engine as _; use sha2::Sha512; diff --git a/crates/socket-patch-cli/tests/repair/repair_invariants.rs b/crates/socket-patch-cli/tests/repair/repair_invariants.rs index 26c808615..af5f31964 100644 --- a/crates/socket-patch-cli/tests/repair/repair_invariants.rs +++ b/crates/socket-patch-cli/tests/repair/repair_invariants.rs @@ -7,18 +7,13 @@ use std::path::{Path, PathBuf}; use std::process::Command; -use crate::common::hermetic_command; +use crate::common::{binary, git_sha256, hermetic_command}; -use sha2::{Digest, Sha256}; use wiremock::matchers::{method, path}; use wiremock::{Mock, MockServer, ResponseTemplate}; const ORG_SLUG: &str = "test-org"; -fn binary() -> PathBuf { - env!("CARGO_BIN_EXE_socket-patch").into() -} - /// A `socket-patch` command rooted at `cwd` with every ambient `SOCKET_*` /// env var scrubbed (`hermetic_command`), so every assertion exercises the flag/argv path and /// nothing the ambient environment happened to leak in: @@ -44,15 +39,6 @@ fn socket_cmd(cwd: &Path) -> Command { cmd } -/// Git-SHA256: SHA256("blob \0" ++ content). -fn git_sha256(content: &[u8]) -> String { - let header = format!("blob {}\0", content.len()); - let mut hasher = Sha256::new(); - hasher.update(header.as_bytes()); - hasher.update(content); - hex::encode(hasher.finalize()) -} - /// A manifest with one patch referencing one blob. Used as the baseline /// `.socket/manifest.json` for every test below. const MANIFEST_JSON: &str = r#"{ diff --git a/crates/socket-patch-cli/tests/scan/covgap_commands_fetch_stage.rs b/crates/socket-patch-cli/tests/scan/covgap_commands_fetch_stage.rs index 5737eacf5..3f267ef7f 100644 --- a/crates/socket-patch-cli/tests/scan/covgap_commands_fetch_stage.rs +++ b/crates/socket-patch-cli/tests/scan/covgap_commands_fetch_stage.rs @@ -16,34 +16,19 @@ //! `coverage_fix_apply_silent_mute_exit.rs`; this suite covers the //! human-mode (non-quiet) output shape and the mem-stager arms. -use std::path::{Path, PathBuf}; +use std::path::Path; -use crate::common::hermetic_command; +use crate::common::{binary, git_sha256, hermetic_command}; -use sha2::{Digest, Sha256}; use wiremock::matchers::{method, path}; use wiremock::{Mock, MockServer, ResponseTemplate}; -fn binary() -> PathBuf { - env!("CARGO_BIN_EXE_socket-patch").into() -} - const ORG_SLUG: &str = "test-org"; const UUID: &str = "11111111-1111-4111-8111-111111111111"; const BEFORE: &[u8] = b"before\n"; const AFTER: &[u8] = b"after\n"; /// base64 of AFTER, the shape the view response's `blobContent` carries. -/// Git-SHA256: SHA256("blob \0" ++ content). Computed independently -/// of the code under test. -fn git_sha256(content: &[u8]) -> String { - let header = format!("blob {}\0", content.len()); - let mut hasher = Sha256::new(); - hasher.update(header.as_bytes()); - hasher.update(content); - hex::encode(hasher.finalize()) -} - /// Spawn the built binary in `root` with the hermetic `SOCKET_*` /// environment (ambient vars scrubbed, telemetry kill-switch forced) and /// `extra_env` injected last so deliberate seeds survive the scrub. From e1b04a64eb26af7378ac45d9215bce26989681e2 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 12 Oct 2026 02:13:32 +0000 Subject: [PATCH 3/3] Tidy comments and imports after helper move Drop a doc comment left with no item under it, rewrap the ratchet's pending-list comment, and import the sha2 Digest trait only inside the one helper that uses it. Refs #824 Assisted-by: Claude Code:claude-opus-5-5 --- crates/socket-patch-cli/tests/cli/shared_helper_copies.rs | 6 +++--- .../tests/repair/covgap_commands_repair_vendor.rs | 3 +-- .../tests/scan/covgap_commands_fetch_stage.rs | 1 - 3 files changed, 4 insertions(+), 6 deletions(-) diff --git a/crates/socket-patch-cli/tests/cli/shared_helper_copies.rs b/crates/socket-patch-cli/tests/cli/shared_helper_copies.rs index 17e4aa097..424de23ea 100644 --- a/crates/socket-patch-cli/tests/cli/shared_helper_copies.rs +++ b/crates/socket-patch-cli/tests/cli/shared_helper_copies.rs @@ -9,9 +9,9 @@ use std::path::Path; /// Files that still define a private `binary()` or `git_sha256`. Each is -/// a shared module whose includers don't all declare `mod common`. Migrate a file onto `common` and delete its entry; -/// a stale entry is not an error, so a PR that migrates one never turns -/// another red. +/// a shared module whose includers don't all declare `mod common`. +/// Migrate a file onto `common` and delete its entry; a stale entry is +/// not an error, so a PR that migrates one never turns another red. const PENDING_PRIVATE_HELPERS: &[&str] = &[ "vex_e2e_common/mod.rs", "vlt_e2e_common/mod.rs", diff --git a/crates/socket-patch-cli/tests/repair/covgap_commands_repair_vendor.rs b/crates/socket-patch-cli/tests/repair/covgap_commands_repair_vendor.rs index 0d100f5c5..534f45ed4 100644 --- a/crates/socket-patch-cli/tests/repair/covgap_commands_repair_vendor.rs +++ b/crates/socket-patch-cli/tests/repair/covgap_commands_repair_vendor.rs @@ -17,7 +17,6 @@ use std::path::{Path, PathBuf}; use crate::common::{binary, git_sha256, hermetic_command}; -use sha2::Digest; use wiremock::matchers::{method, path}; use wiremock::{Mock, MockServer, ResponseTemplate}; @@ -41,7 +40,7 @@ const GEMSPEC_STUB: &[u8] = b"Gem::Specification.new do |s|\n s.name = \"padloc fn sri_of(bytes: &[u8]) -> String { use base64::Engine as _; - use sha2::Sha512; + use sha2::{Digest as _, Sha512}; format!( "sha512-{}", base64::engine::general_purpose::STANDARD.encode(Sha512::digest(bytes)) diff --git a/crates/socket-patch-cli/tests/scan/covgap_commands_fetch_stage.rs b/crates/socket-patch-cli/tests/scan/covgap_commands_fetch_stage.rs index 3f267ef7f..f1d559a21 100644 --- a/crates/socket-patch-cli/tests/scan/covgap_commands_fetch_stage.rs +++ b/crates/socket-patch-cli/tests/scan/covgap_commands_fetch_stage.rs @@ -27,7 +27,6 @@ const ORG_SLUG: &str = "test-org"; const UUID: &str = "11111111-1111-4111-8111-111111111111"; const BEFORE: &[u8] = b"before\n"; const AFTER: &[u8] = b"after\n"; -/// base64 of AFTER, the shape the view response's `blobContent` carries. /// Spawn the built binary in `root` with the hermetic `SOCKET_*` /// environment (ambient vars scrubbed, telemetry kill-switch forced) and