Repository navigation
Vendored Maven, Gradle and NuGet artifacts can be git-ignored silently, because only npm checks .gitignore #1061
Description
[agent] Filed by the October 7 architecture audit campaign (ecosystems). Register: arch-audit register.
Kind: bug. Source: audit B32 (new finding), register E80.
Problem: the check that a vendored artifact isn't git-ignored exists only for the npm family (npm_common.rs#L192, npm_dir gitignore_probe) and as owned !* .gitignore files in the sbt and Coursier trees. Vendored Maven writes {artifact}-{version}.jar (maven_repo.rs), the Maven reactor and Gradle trees write jars, and vendored NuGet writes <id>.<ver>.nupkg (nuget_feed.rs#L106); none of them check. GitHub's stock Java.gitignore ignores *.jar and VisualStudio.gitignore ignores *.nupkg.
Symptoms: #620 (the Gradle twin). #831 (yarn classic twin, fixed). Impact: vendor exits 0 and the local build works, but the commit silently drops the payload; every fresh clone fails (closed: vendor --check exits 1, VEX omits the purl). Low priority per the maintainer's ecosystem triage.
Proposed change: hoist the gitignore preflight (or the owned !* .gitignore) into the shared vendored sink so every backend's artifact root gets it; delete the npm-only special case.
Size and scope: vendor/common.rs, npm_common.rs, maven_repo.rs, nuget_feed.rs, jvm/*; about 150 lines.
Acceptance criteria:
- Vendored Maven, the Maven reactor, Gradle and NuGet refuse (or re-include) an ignored artifact the same way npm does.
- A regression test per backend with a stock template
.gitignore. - Fixes Vendored Gradle exits 0 when the project's .gitignore excludes *.jar, so the commit silently drops the patched jar and every fresh checkout fails to build #620 too.
Dependencies: none. Coordinate with #1032 (vendor::jvm::layout).
Generated by Claude Code
Activity
Reconcile the ledger with the October 7 audit
mikolalysenko commentedon Oct 7, 2026
[agent] Triage: priority:p3 (Maven/Gradle/NuGet). Shares root cause with #620: the vendored gitignore preflight exists only for the npm family (
vendor/npm_common.rs), so no JVM or NuGet backend checks whether its artifact is ignored. Will be fixed together.Generated by Claude Code
mikolalysenko commentedon Oct 9, 2026
v5 release blocker (P1). The documented commit-and-install vendored workflow must include its actual artifacts despite common .jar/.nupkg ignore rules. #620 is the Gradle reproduction of this shared problem.
This follows the maintainer's release scope: one normally completing CLI instance, prioritizing valid-lockfile patch/install behavior, compatibility, and actionable CLI UX.
#620 is being closed only as duplicate scheduling. Preserve its real Gradle
*.jarrepro and acceptance conditions here.mikolalysenko commentedon Oct 9, 2026
[agent] Claiming for v5 blocker burn-down (shared root cause: the vendored-artifact .gitignore preflight exists only in the npm-family sink). Branch: agent/v5-vendored-gitignore-all. Claim-ID: 2026-10-09T16:41:47Z-ad13f0
Keep vendored JVM and NuGet artifacts committable
Refuse ignored vendor roots before takeover