Bench: serve yarn classic tarballs; allow NuGet stale-cache warning

[Mikola Lysenko (mikolalysenko)]

What main changed

Two merged changes in f3c6313a..17793173 broke three scenarios' validation on main:

• Fix fragmentless yarn classic hosted pins (#558) #1328 (5096c41a, Hosted yarn classic rewrite drops the #sha1 fragment when the grant has no sha1, so yarn's cache serves stale bytes: yarn ≤1.17 silently installs the unpatched package, and yarn ≥1.19 fails every warm-cache install #558/Yarn classic: a patch that adds a dependency to the package's own package.json leaves vendored yarn.lock with a dangling dependency (offline frozen install fails, lock churns), and hosted silently installs without it #591): yarn classic's hosted pin now downloads each served tarball, checks it against the grant's sha512 and reads its package.json before pinning. The mock didn't serve those URLs, so yarn-classic/hosted and yarn-classic/rescan were INVALID with 60 unexpected GET /patch/npm/.../*.tgz requests.
• Stop warm NuGet cache shadowing patches (#352) #1344 (10874cc3, Vendored and hosted NuGet patches are shadowed by a warm global packages folder: silently unpatched without a lock, NU1403 with one #352): a hosted NuGet scan now warns redirect_nuget_stale_global_package for each patched package whose unpatched copy is already in ~/.nuget/packages. nuget/hosted and nuget/rescan were INVALID with 25 unexpected warnings.

Both are correct new behavior. Neither is a CLI bug.

Suite changes

• Updated, npm fixtures: artifact_bytes is now a real, deterministic npm .tgz (package/package.json with the installed copy's dependencies, so nothing new needs locking, plus package/index.js; fixed mtimes and modes). A shared serve_artifacts helper serves it for both vlt (sha512 preflight, as before) and yarn classic (the Fix fragmentless yarn classic hosted pins (#558) #1328 fetch). yarn-classic/hosted now expects 187 requests (127 + 60 tarballs). yarn-classic/rescan stays at 127, because its pins are already in place.
• Updated, nuget fixture: allows redirect_nuget_stale_global_package. A freshly restored project really does hold the unpatched copies, and NuGet would restore them ahead of the Socket source, so the warning is right.
• Deps: adds tar and flate2 to the bench crate. Both are already workspace-pinned, so Cargo.lock only gains the bench package's two dependency lines.
• Added or removed scenarios: none.

Validation

• cargo fmt -p socket-patch-bench, cargo clippy -p socket-patch-bench --all-features --all-targets -- -D warnings and cargo test -p socket-patch-bench (29 passed) are all clean.
• A full run on main 17793173 validates 45/45 scenarios (it was 41/45 without this PR).
• A/A compare (head vs. a copy of head, 8 pairs) on yarn-classic/*, nuget/* and vlt/* shows no regressions; every row is ≈.
• strace -f -e trace=execve on yarn-classic/hosted: the CLI spawns nothing.
• A base binary from before Fix fragmentless yarn classic hosted pins (#558) #1328 still validates yarn-classic/* (it just doesn't fetch the tarballs), so the CI gate's A/B keeps working across the change.

Time budget

No new scenarios. yarn-classic/hosted takes about 0.27 s more per run. That's the CLI regression tracked in the linked issue, not the fixture. Fixture build time is unchanged within noise.

Related

The daily bench run found confirmed regressions in this range. They are filed separately and this PR doesn't fix them: yarn-classic (#1328), golang (#1403) and nuget.

🤖 Generated with Claude Code

https://claude.ai/code/session_01La9tujwhm1nYeFya6EL1DF

---

Generated by Claude Code

---

Note

Low Risk
Changes are limited to benchmark fixture mocks and expected warnings; no production CLI or scan logic is modified.

Overview
Updates the socket-patch-bench harness so validation matches recent CLI behavior: yarn classic hosted pins now fetch served patch tarballs, and NuGet hosted scans warn when unpatched copies already sit in the global package cache.

npm fixtures: Patched-package mock artifacts are no longer placeholder bytes—they are deterministic gzip .tgz archives with package/package.json (shared via manifest_json) and package/index.js, so sha512 checks and tarball package.json reads behave like production. A shared serve_artifacts registers those bytes at each grant URL for both yarn classic and vlt (replacing the vlt-only inline loop).

NuGet fixture: The scenario now allows the redirect_nuget_stale_global_package warning, which matches a restored project that still has unpatched packages under ~/.nuget/packages.

Dependencies: Adds workspace tar and flate2 to socket-patch-bench only.

^{Reviewed by Cursor Bugbot for commit a05f705. Configure here.}

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

bugbot run

---

Generated by Claude Code

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit a05f705. Configure here.}

[Mikola Lysenko (mikolalysenko)]

Ready for review (burn-down agent)

• Head: a05f705
• CI: 35/35 non-skipped checks green (19 skipped by path filters); mergeable, no conflicts, no CHANGELOG.md change.
• Bugbot: reviewed a05f705, no issues found; no open review threads.
• Reviewer focus: bench-only change. The bench mock now serves yarn classic tarballs (needed since Fix fragmentless yarn classic hosted pins (#558) #1328) and accepts the NuGet stale-cache warning added in Stop warm NuGet cache shadowing patches (#352) #1344. Adds tar/flate2 to socket-patch-bench only.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

Final review brief

What it does: Bench-harness-only fix. Since #1328, yarn classic's hosted pin downloads each served tarball and reads its package.json, and since #1344 a hosted NuGet scan warns redirect_nuget_stale_global_package; the bench mock didn't serve the tarballs or allow the warning, so 4 scenarios validated as INVALID on main. This serves real, deterministic npm tarballs for yarn classic and vlt, and allows the NuGet warning.

Risk: low. Only crates/socket-patch-bench changes; no CLI or core code. The two new deps (tar, flate2) are already workspace-pinned, so Cargo.lock only gains two dependency lines.

Look here:

• npm.rs#L239: artifact_bytes now builds a real .tgz (fixed mtime/mode; gzip header mtime defaults to 0, so bytes are deterministic and the grant's sha512 stays stable)
• npm.rs#L264: shared serve_artifacts, now used by yarn classic (L579) as well as vlt (L862)
• other.rs#L719: NuGet fixture allows the stale-global-package warning

Verified: read the full diff. The vlt preflight sha512 (sri_of(&artifact_bytes(p))) and the served bytes still come from the same function, so they can't drift. cargo test -p socket-patch-bench passes locally (29/29). CI ci-ok and clippy are green on a05f705. Bugbot reviewed this head with no findings. No unresolved threads, and CHANGELOG.md is untouched.

Changes I made: none.

Open questions: none.

Auto-merge is armed, so approving sends this straight to the merge queue.

---

Generated by Claude Code