Repository navigation
Vendored Maven payload is written under the lowercased GAV, so mixed-case artifacts silently fall through to Central on case-sensitive file systems #272
Description
Activity
[agent] Correction from the Linux CI run (depscan run 36261631322, 13 Maven lines on ubuntu-latest): on a case-sensitive filesystem the vendored modes do not fall through to Central. They refuse with
package_not_installed, because the crawler looks for the lowercased~/.m2/repository/com/zaxxer/hikaricp/…path and doesn't find it.--vendor-source servicealso refuses withpackage_not_installed; on macOS it refuses withvendor_prebuilt_required. So Linux fails closed.The remaining harm is on case-insensitive filesystems (macOS, Windows). There the payload is written at the lowercased path and only works because the filesystem ignores case. The committed tree then breaks for any teammate or CI job on Linux.
One more consequence of the two-step flow: after
get --save-only, a refusedvendorleaves the agent-mode.socket/manifest.jsonin place. SBOM tools that trust the manifest then report a patch that was never delivered.
[agent] Filed by Claude Code on behalf of Mikola Lysenko (@mikolalysenko) while adding Maven patch SBOM annotations to depscan. Reproduced with a release build of socket-patch
3efdc31d(sha256dc5fb57f…), a stub patch API, and real Apache Maven 2.2.1 through 4.0.0-rc-7 (13 lines) on macOS arm64 / JDK 26.Severity: high on case-sensitive file systems (Linux CI): the vendored patch is silently not consumed.
Cells:
mixed-case×vendored-vendor,vendored-get,vendored-scan-detached, all 13 lines (39 cells, FAIL onthe harness's exact-case check). On darwin (case-insensitive APFS) Maven still consumes the patched jar, so the
build proof passes there.
Repro:
get c0dec501-0a1b-4c2d-8e3f-000000000105 --id --mode vendored --vendor-source buildon a project thatdeclares
com.zaxxer:HikariCP:5.0.1(the stub's view purl is the production-shapedpkg:maven/com.zaxxer/hikaricp@5.0.1?ext=jar)..socket/vendor/maven/c0dec501-…/com/zaxxer/hikaricp/5.0.1/hikaricp-5.0.1.{jar,pom}andsocket-patch.vendor.jsonpurl: pkg:maven/com.zaxxer/hikaricp@5.0.1.com/zaxxer/HikariCP/5.0.1/HikariCP-5.0.1.jarfrom the file repository. On Linux that is a miss,and Maven falls through to Central's pristine jar (not run here; inferred from the path).
vendor_maven_local_cache_shadowadvice names the wrong case too:-DmanualInclude=com.zaxxer:hikaricp,~/.m2/repository/com/zaxxer/hikaricp/5.0.1.~/.m2/.../HikariCP/...case-insensitively. OnLinux expect
vendor_maven_jar_not_foundinstead (not run).parseSocketPURL/SREF, P9). But the CLI has the realspelling in the crawled pom and the project pom, and should build the maven2 path from those.