Report NuGet patches shadowed by a warm cache

A NuGet patch keeps the upstream id and version, and NuGet restores a
package already extracted into its global packages folder without
asking any source. On the machine that ran socket-patch (and any CI
runner with a restored cache) the upstream copy shadowed the Socket
source: restore silently kept the unpatched bytes without a lock, or
failed NU1403 with one, while scan reported success, the no-lockfile
warning said the feed "forces" the patched copy, and the in-run VEX
attested the package not_affected.

Hosted and vendored runs now compare the global packages folder's
copy (.nupkg.metadata contentHash) with the patched package and warn
(redirect_ / vendor_nuget_stale_global_package) with the directory and
a working remedy: delete it or clear the folder, then dotnet restore,
and drop it from CI caches. Like the gem stale-install guard the probe
is read-only (the folder is shared machine-wide), re-fires until the
copy is gone, and a flagged hosted purl is withheld from the same-run
VEX attestation.

Fixes #352.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Author: mikolalysenko

crates/socket-patch-cli/CLI_CONTRACT.md

@@ -1366,6 +1366,7 @@ Every `--json` invocation emits a single JSON object that follows the **unified
 | `redirect_unattributable` | `redirect.skipped[].reason` | scan/get `--mode hosted`: the rewriters would pin the patch, but lockfile discovery over the result reads that pin as contested (another lock or requirements file resolves the same version elsewhere, or the pin is not one the package manager consumes), so `vex`, `rollback`, `remove` and `vendor` would refuse it. The candidate is left out of the rewrite, so nothing is written for it; the detail carries discovery's findings. Exit code unchanged. |
 | `redirect_pin_lockless` | `redirect.warnings[]` (warning) | scan/get `--mode hosted` (nuget, cargo): the pin was written without a lockfile that records its version, so `vex` cannot attest it and `rollback` / `remove` / `vendor` refuse it as unattributable. The detail names the lockfile to create (`dotnet restore --use-lock-file`, `cargo generate-lockfile`) before re-running the hosted scan. |
 | `redirect_pypi_stale_install` | `redirect.warnings[]` (warning) | Hosted Python redirect: readable installed files differ from patched hashes. Read-only, repeated on re-scan, and excludes the package from same-run VEX. See the "Python stale-install guard" section. |
+| `redirect_nuget_stale_global_package` / `vendor_nuget_stale_global_package` | `redirect.warnings[]` / the vendor result's `warnings` (warning) | scan `--mode hosted` / `vendor` / `scan --mode vendored` (nuget, v5.0 #352): NuGet's global packages folder (`NUGET_PACKAGES`, else `~/.nuget/packages`) already holds the patched package extracted from other bytes (its `.nupkg.metadata` `contentHash` is not the patched one). A patch keeps the upstream id and version and NuGet restores a package already in that folder without asking any source, so `dotnet restore` would keep the upstream bytes (silently without a lock, NU1403 against the re-pinned lock with one). The detail names the directory and the remedy: delete it (or `dotnet nuget locals global-packages --clear`), then `dotnet restore`; CI caches of that folder must drop it too. Read-only like the gem guard (the folder is shared machine-wide), re-fired on every re-run until the copy is gone, skipped on `--dry-run`; a hosted purl it flags is excluded from the same run's `--vex` `assume_applied` and reported stale. A dir without `.nupkg.metadata` (a legacy `packages/` folder) is never judged. |
 | `redirect_gem_stale_install` | `redirect.warnings[]` (warning) | scan `--mode hosted` (gem): a stale UNPATCHED materialization (installed gem, or committed archive in bundler's cache dir — `vendor/cache` unless `cache_path` moves it) that `bundle install` will reuse instead of fetching the redirected patch; the detail carries the verified remedy. Full rules and flavors: the "Gem stale-install guard" section. |
 | `redirect_gem_version_not_locked` | `redirect.warnings[]` (warning) | scan `--mode hosted` (gem): the crawled gem version is installed on the machine but no `GEM` section of the project's lock resolves it (another project's copy in the shared gem home). The gem is skipped and the Gemfile and lock stay byte-identical. |
 | `redirect_pipenv_refused` | `redirect.warnings[]` (warning) | scan `--mode hosted` (pipenv): the Pipfile.lock pins another version or a non-registry / foreign source for the package — refused atomically across categories, and the patch is vetoed from the sibling Python rewriters (see the "Pipenv hosted redirect" section). |

crates/socket-patch-cli/src/commands/scan/hosted.rs

@@ -21,6 +21,7 @@ use crate::commands::vex::generate_vex_from_manifest_path;
 
 use super::{discover_selected, ScanArgs};
 
+mod nuget;
 mod python;
 mod takeover;
 
@@ -1380,6 +1381,15 @@ pub(crate) async fn run_redirect_selected(
         .await
     };
 
+    // NuGet global packages folder probe (#352): a copy extracted from the
+    // upstream bytes shadows the Socket source. Read-only, like the gem
+    // probe; skipped on --dry-run for the same reason.
+    let nuget_stale = if common.dry_run {
+        StaleInstallOutcome::default()
+    } else {
+        nuget::stale_install_warnings(common, &confirmed, &done.overrides).await
+    };
+
     // vlt warm-tree heal: stale installed copies of the Socket-owned nodes
     // are invalidated (classified only on a dry run or
     // with --no-vlt-install-cleanup), and every confirmed vlt purl whose
@@ -1539,6 +1549,7 @@ pub(crate) async fn run_redirect_selected(
             .map(|(purl, _)| purl.clone())
             .filter(|purl| {
                 !gem_stale.stale_purls.contains(purl)
+                    && !nuget_stale.stale_purls.contains(purl)
                     && !python_stale.stale_purls.contains(purl)
                     && !vlt_stale.stale_purls.contains(purl)
             })
@@ -1549,6 +1560,7 @@ pub(crate) async fn run_redirect_selected(
         params.known_stale = python_stale
             .stale_purls
             .iter()
+            .chain(&nuget_stale.stale_purls)
             .chain(&vlt_stale.stale_purls)
             .cloned()
             .collect();
@@ -1578,6 +1590,7 @@ pub(crate) async fn run_redirect_selected(
     let mut warnings: Vec<serde_json::Value> =
         socket_patch_core::hosted::render::rewrite_warnings_json(&engine_warnings);
     warnings.extend(gem_stale.warnings.iter().cloned());
+    warnings.extend(nuget_stale.warnings.iter().cloned());
     warnings.extend(python_stale.warnings.iter().cloned());
     warnings.extend(vlt_stale.warnings.iter().cloned());
     warnings.extend(takeover_pre_warnings.iter().cloned());

crates/socket-patch-cli/src/commands/scan/hosted/nuget.rs

@@ -0,0 +1,88 @@
+//! Read-only check of NuGet's global packages folder for hosted redirects
+//! (#352).
+//!
+//! A hosted NuGet patch keeps the upstream id and version, and NuGet
+//! restores a package already extracted into its global packages folder
+//! (`NUGET_PACKAGES`, else `~/.nuget/packages`) without asking any source.
+//! A copy extracted from the upstream bytes therefore shadows the Socket
+//! source: without a lock the restore silently keeps the unpatched bytes,
+//! with one it fails NU1403. Like the gem stale-install guard, nothing is
+//! deleted: the remedy is prescribed, and the purl is withheld from the
+//! same-run VEX attestation.
+
+use socket_patch_core::crawlers::NuGetCrawler;
+use socket_patch_core::patch::redirect::DepOverride;
+use socket_patch_core::utils::purl::strip_purl_qualifiers;
+use socket_patch_core::vendor::nuget_feed::{extracted_content_hash, stale_global_package_detail};
+
+use super::StaleInstallOutcome;
+
+/// Warn for every confirmed NuGet redirect whose package the global
+/// packages folder already holds extracted from bytes other than the
+/// patched ones. A dir without `.nupkg.metadata` (a legacy `packages/`
+/// folder) is never judged: there is no positive evidence.
+pub(super) async fn stale_install_warnings(
+    common: &crate::args::GlobalArgs,
+    confirmed: &[(String, String)],
+    overrides: &[DepOverride],
+) -> StaleInstallOutcome {
+    let mut out = StaleInstallOutcome::default();
+    // (purl, the patched package's NuGet content hash)
+    let candidates: Vec<(&String, String)> = confirmed
+        .iter()
+        .filter(|(purl, _)| purl.starts_with("pkg:nuget/"))
+        .filter_map(|(purl, uuid)| {
+            let sha512 = overrides
+                .iter()
+                .find(|o| o.ecosystem == "nuget" && &o.patch_uuid == uuid)?
+                .integrity
+                .sha512
+                .as_deref()?;
+            Some((
+                purl,
+                sha512.strip_prefix("sha512-").unwrap_or(sha512).to_string(),
+            ))
+        })
+        .collect();
+    if candidates.is_empty() {
+        return out;
+    }
+    let crawler = NuGetCrawler::new();
+    let Ok(paths) = crawler
+        .get_nuget_package_paths(&common.crawler_options())
+        .await
+    else {
+        return out;
+    };
+    let purls: Vec<String> = candidates
+        .iter()
+        .map(|(purl, _)| strip_purl_qualifiers(purl).to_string())
+        .collect();
+    for path in &paths {
+        let Ok(found) = crawler.find_by_purls(path, &purls).await else {
+            continue;
+        };
+        for (purl, patched) in &candidates {
+            let Some(pkg) = found.get(strip_purl_qualifiers(purl)) else {
+                continue;
+            };
+            let Some(cached) = extracted_content_hash(&pkg.path).await else {
+                continue;
+            };
+            if cached == *patched || out.stale_purls.contains(*purl) {
+                continue;
+            }
+            out.warnings.push(serde_json::json!({
+                "code": "redirect_nuget_stale_global_package",
+                "detail": stale_global_package_detail(
+                    &pkg.name,
+                    &pkg.version,
+                    &pkg.path,
+                    "the Socket source",
+                ),
+            }));
+            out.stale_purls.insert((*purl).clone());
+        }
+    }
+    out
+}

crates/socket-patch-cli/tests/e2e_nuget_dotnet_build.rs

@@ -773,37 +773,60 @@ fn nuget_hosted_dotnet_restore_then_manifestless_vex() {
     let backend = Backend::start(HOSTED_UUID, &pristine, &patched, Some(&nupkg));
     let uri = backend.uri();
 
-    // `scan --mode hosted --vex`: the real rewriter + the in-run VEX.
-    let embedded = fixture.join("scan.vex.json");
-    let (code, env, stderr) = socket_patch(
-        &fixture,
-        &store_fx,
-        &[
-            "scan",
-            "--mode",
-            "hosted",
-            "--json",
-            "--yes",
-            "--api-url",
-            &uri,
-            "--org",
-            ORG,
-            "--api-token",
-            "fake-token",
-            "--patch-server-url",
-            &uri,
-            "--vex",
-            embedded.to_str().unwrap(),
-            "--vex-product",
-            PRODUCT,
-        ],
-    );
+    // `scan --mode hosted`: the real rewriter. The fixture restore left the
+    // UPSTREAM copy in the global packages folder, which NuGet would restore
+    // instead of asking the Socket source (#352): the run says so, names
+    // the directory to delete, and keeps saying so on re-runs until it is.
+    let hosted_args = [
+        "scan",
+        "--mode",
+        "hosted",
+        "--json",
+        "--yes",
+        "--api-url",
+        &uri,
+        "--org",
+        ORG,
+        "--api-token",
+        "fake-token",
+        "--patch-server-url",
+        &uri,
+    ];
+    let (code, env, stderr) = socket_patch(&fixture, &store_fx, &hosted_args);
     assert_eq!(
         code,
         Some(0),
         "SDK {sdk} scan --mode hosted: {env:#}\n{stderr}"
     );
     assert_eq!(env["redirect"]["redirected"], 1, "{env:#}");
+    let stale_dir = pkg_dir(&store_fx);
+    let warned = env.to_string();
+    assert!(
+        warned.contains("redirect_nuget_stale_global_package")
+            && warned.contains(&stale_dir.display().to_string()),
+        "SDK {sdk}: the warm global packages folder is reported: {env:#}"
+    );
+    // The prescribed remedy, then the idempotent re-run with the in-run VEX.
+    std::fs::remove_dir_all(&stale_dir).unwrap();
+    let embedded = fixture.join("scan.vex.json");
+    let mut vex_args = hosted_args.to_vec();
+    vex_args.extend([
+        "--vex",
+        embedded.to_str().unwrap(),
+        "--vex-product",
+        PRODUCT,
+    ]);
+    let (code, env, stderr) = socket_patch(&fixture, &store_fx, &vex_args);
+    assert_eq!(
+        code,
+        Some(0),
+        "SDK {sdk} scan --mode hosted --vex: {env:#}\n{stderr}"
+    );
+    assert!(
+        !env.to_string()
+            .contains("redirect_nuget_stale_global_package"),
+        "SDK {sdk}: nothing stale once the copy is gone: {env:#}"
+    );
     let doc: Value = serde_json::from_slice(&std::fs::read(&embedded).unwrap()).unwrap();
     assert_attested(&doc, PURL, HOSTED_UUID, Marker::Redirected, &vulns());
     let config = std::fs::read_to_string(fixture.join("nuget.config")).unwrap();
@@ -916,6 +939,13 @@ fn nuget_vendored_dotnet_restore_then_manifestless_vex() {
         Some(0),
         "SDK {sdk} scan --mode vendored: {env:#}\n{stderr}"
     );
+    // The fixture restore's UPSTREAM copy in the global packages folder
+    // would shadow the vendored feed on this machine (#352): reported.
+    assert!(
+        env.to_string()
+            .contains("vendor_nuget_stale_global_package"),
+        "SDK {sdk}: the warm global packages folder is reported: {env:#}"
+    );
     let doc: Value = serde_json::from_slice(&std::fs::read(&embedded).unwrap()).unwrap();
     assert_attested(&doc, PURL, VENDORED_UUID, Marker::Vendored, &vulns());
     let artifact = fixture.join(format!(".socket/vendor/nuget/{VENDORED_UUID}/{NUPKG_NAME}"));