test(manifest): resolve the JVM compat fixtures' deps from generated stub artifacts

.gitignore

@@ -294,13 +294,14 @@ pnpm-debug.log
 /packages/cli/src/commands/manifest/scripts/test/gradle-compat/project/.socket.facts.json
 /packages/cli/src/commands/manifest/scripts/test/gradle-compat/project/.gradle/
 /packages/cli/src/commands/manifest/scripts/test/gradle-compat/project/build/
-/packages/cli/src/commands/manifest/scripts/test/gradle-compat/.gradle-home/
 /packages/cli/src/commands/manifest/scripts/test/gradle-compat/.populate-for.txt
+/packages/cli/src/commands/manifest/scripts/test/maven-compat/project/localrepo/
 /packages/cli/src/commands/manifest/scripts/test/maven-compat/project/records.tsv
 /packages/cli/src/commands/manifest/scripts/test/maven-compat/project/target/
 /packages/cli/src/commands/manifest/scripts/test/maven-compat/project/*/target/
 /packages/cli/src/commands/manifest/scripts/test/sbt-compat/project/target/
 /packages/cli/src/commands/manifest/scripts/test/sbt-compat/project/project/target/
 /packages/cli/src/commands/manifest/scripts/test/sbt-compat/project/project/build.properties
 /packages/cli/src/commands/manifest/scripts/test/sbt-compat/project/scala-version.sbt
+/packages/cli/src/commands/manifest/scripts/test/sbt-compat/project/localrepo/
 /packages/cli/src/commands/manifest/scripts/test/sbt-compat/project/records.tsv

packages/cli/src/commands/manifest/scripts/test/README.md

@@ -23,3 +23,35 @@ sbt rows also need the `sbt` launcher on `PATH`.
 The runner downloads the build-tool distributions and invokes the per-ecosystem
 `smoke-test.sh`. The unit-level assembler/sidecar behavior is covered separately
 by the `*.test.mts` unit tests.
+
+## Stub dependencies
+
+All three fixtures declare their dependencies as stub artifacts — empty jars plus
+generated poms — that `make-stub-repo.sh` writes into a file-based Maven repo at
+test time. The fixtures only need the _shape_ of a dependency graph (a prod dep, a
+test dep, a transitive), never the code, so a stub is behaviourally identical here
+and can never age into a CVE alert or a version bump. The generated repos are
+gitignored; nothing binary is committed.
+
+Each build tool still fetches its own closure — Maven's plugins, sbt's
+scala-library, the Gradle distribution — from the network, so these fixtures are
+not "fully offline"; they simply declare no third-party dependencies of their own.
+Gradle is the exception: it also passes `--offline` and resolves everything it
+needs for the smoke test from the stub repo.
+
+## Caches
+
+No suite reads or writes the developer's own caches. Maven gets its local
+repository from `-Dmaven.repo.local`, Gradle its user home from `-g`, and sbt its
+Ivy home from `-Dsbt.ivy.home` plus `COURSIER_CACHE`, all under one root that
+`compat-cache.sh` resolves:
+
+```
+${SOCKET_COMPAT_CACHE:-${TMPDIR:-/tmp}/socket-manifest-compat}
+```
+
+That root is stable, so each tool's own closure is downloaded once and reused; the
+first run after clearing it pays for the download. The _stub_ artifacts are evicted
+from it before every run, so a run can never pass on a stale copy of the thing
+under test. Set `SOCKET_COMPAT_CACHE` to a fresh `mktemp -d` for a completely cold
+run.

packages/cli/src/commands/manifest/scripts/test/compat-cache.sh

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+# Shared cache root for the JVM compat suites: the downloaded build-tool distributions plus each
+# tool's dependency cache. Keeping the caches here rather than in ~/.m2, ~/.gradle and ~/.ivy2 means
+# a run can't pass off a warm home cache, can't write a home path into the records it emits, and
+# can't leave anything behind in the developer's own caches. Point SOCKET_COMPAT_CACHE at a fresh
+# `mktemp -d` for a cold run.
+SOCKET_COMPAT_CACHE="${SOCKET_COMPAT_CACHE:-${TMPDIR:-/tmp}/socket-manifest-compat}"
+mkdir -p "$SOCKET_COMPAT_CACHE"

packages/cli/src/commands/manifest/scripts/test/gradle-compat/.gradle-home/caches/8.14/groovy-dsl/40eebb7fa45b3770a072424730a8a959/metadata/metadata.bin

@@ -0,0 +1 @@
+

packages/cli/src/commands/manifest/scripts/test/gradle-compat/.gradle-home/caches/8.14/groovy-dsl/839e58da451023bf932576ba495dc49c/metadata/metadata.bin

@@ -0,0 +1 @@
+

packages/cli/src/commands/manifest/scripts/test/gradle-compat/.gradle-home/caches/8.14/groovy-dsl/b2c91c80a24a1c3e529dfbd233626a12/metadata.bin

@@ -0,0 +1,2 @@
+›2l4c2rmbhjhmlmosbaofuf4q3yþ œÖȇüßÿtê´ôø“instrumentedOutput
0È\~~*P{xªÅ¦HÎ÷ŒmetadataDir
Ó«Žž#4Oõe
+ð؉œpropertyUpgradeReportOutput
²´ÆyàÞœ3Ÿ&þÍË;ŒÕ

packages/cli/src/commands/manifest/scripts/test/gradle-compat/.gradle-home/caches/8.14/groovy-dsl/bdca522d30a4b8ff7282b988b9895621/metadata.bin

@@ -0,0 +1,3 @@
+›2l4c2rmbhjhmlmosbaofuf4q3y®^ÖªvÂÜÆR¤äù⥓instrumentedOutput
zÂk³r¥ÈØŽC4‚
+ŒmetadataDir
Ó«Žž#4Oõe
+ð؉œpropertyUpgradeReportOutput
²´ÆyàÞœ3Ÿ&þÍË;ŒÕ

packages/cli/src/commands/manifest/scripts/test/gradle-compat/.gradle-home/caches/8.14/groovy-dsl/bde3c4434d09e9669f4bef28942a7791/metadata/metadata.bin

@@ -0,0 +1 @@
+

packages/cli/src/commands/manifest/scripts/test/gradle-compat/.gradle-home/caches/CACHEDIR.TAG

@@ -0,0 +1,4 @@
+Signature: 8a477f597d28d172789f06886806bc55
+# This file is a cache directory tag created by Gradle.
+# For information about cache directory tags, see:
+#	https://bford.info/cachedir/

packages/cli/src/commands/manifest/scripts/test/gradle-compat/.gradle-home/caches/journal-1/file-access.properties

@@ -0,0 +1,2 @@
+#Fri Jul 31 22:52:34 EDT 2026
+inceptionTimestamp=1785552754736

packages/cli/src/commands/manifest/scripts/test/gradle-compat/.gradle-home/daemon/CACHEDIR.TAG

@@ -0,0 +1,4 @@
+Signature: 8a477f597d28d172789f06886806bc55
+# This file is a cache directory tag created by Gradle.
+# For information about cache directory tags, see:
+#	https://bford.info/cachedir/

packages/cli/src/commands/manifest/scripts/test/gradle-compat/.gradle-home/native/0.2.7/aarch64-macos/libgradle-fileevents.dylib.lock

@@ -0,0 +1 @@
+

packages/cli/src/commands/manifest/scripts/test/gradle-compat/.gradle-home/native/1def1411415f61bf3af743bc5b6707747c0891f09f0c88961ee8f79bc544acac/osx-aarch64/libnative-platform-curses.dylib.lock

@@ -0,0 +1 @@
+

packages/cli/src/commands/manifest/scripts/test/gradle-compat/.gradle-home/native/1def1411415f61bf3af743bc5b6707747c0891f09f0c88961ee8f79bc544acac/osx-aarch64/libnative-platform.dylib.lock

@@ -0,0 +1 @@
+

packages/cli/src/commands/manifest/scripts/test/gradle-compat/README.md

@@ -13,7 +13,7 @@ could silently rot. This smoke test exercises them.
 
 ## What it does
 
-`smoke-test.sh <path-to-gradle>` generates a tiny **local** Maven repo (`make-localrepo.sh` — two
+`smoke-test.sh <path-to-gradle>` generates a tiny **local** Maven repo (`../make-stub-repo.sh` — two
 transitive-free artifacts, a prod `demo.lib:foo` and a test `demo.test:bar`), runs the init script's
 `socketFacts` task against `project/` **fully offline**, and asserts the emitted RECORDS (the script's
 only output — the TS assembler that turns records into `.socket.facts.json` is covered by

packages/cli/src/commands/manifest/scripts/test/gradle-compat/project/build.gradle

@@ -1,6 +1,6 @@
 // Hermetic smoke-test project for ../../socket-facts.init.gradle.
 //
-// Resolves two artifacts from a generated local Maven repo (see ../make-localrepo.sh)
+// Resolves two artifacts from a generated local Maven repo (see ../../make-stub-repo.sh)
 // so it runs fully OFFLINE on every Gradle version — including pre-3.3, which the
 // script must still support (old Gradle can't negotiate modern Maven Central's TLS,
 // so a network repo would make the old-version matrix entries impossible to test).

packages/cli/src/commands/manifest/scripts/test/gradle-compat/smoke-test.sh

@@ -16,10 +16,12 @@ HERE="$(cd "$(dirname "$0")" && pwd)"
 GRADLE="${1:?usage: smoke-test.sh <path-to-gradle-binary>}"
 INIT="$HERE/../../socket-facts.init.gradle"
 PROJECT="$HERE/project"
-GUH="$HERE/.gradle-home"   # isolated Gradle user home -> hermetic, no global init scripts
 RECORDS="$PROJECT/records.tsv"
+# shellcheck source=SCRIPTDIR/../compat-cache.sh
+. "$HERE/../compat-cache.sh"
+GUH="$SOCKET_COMPAT_CACHE/gradle-home"   # isolated Gradle user home -> hermetic, no global init scripts
 
-bash "$HERE/make-localrepo.sh"
+bash "$HERE/../make-stub-repo.sh" "$PROJECT/localrepo" 'demo.lib:foo:1.0' 'demo.test:bar:1.0'
 rm -rf "$GUH" "$RECORDS" "$PROJECT/.gradle" "$PROJECT/build"
 
 echo "+ $("$GRADLE" --version 2>/dev/null | sed -n 's/^Gradle //p' | head -1)"

packages/cli/src/commands/manifest/scripts/test/make-stub-repo.sh

@@ -0,0 +1,74 @@
+#!/usr/bin/env bash
+# Generate a hermetic file-based Maven repository of stub artifacts for the JVM compat fixtures.
+# Each stub gets a .pom and an empty-but-valid .jar in standard repo layout, so a build tool can
+# resolve the declared graph shape without reaching a network repository. The fixtures never compile
+# against or execute these artifacts — only their coordinates and scopes are observed — so stubs are
+# behaviourally identical to the real thing here, and they can never age into a CVE or a version bump.
+#
+# Text-only in git: everything under <repo-dir> is produced at test time and gitignored.
+#
+# Usage: make-stub-repo.sh <repo-dir> <spec>...
+#   spec = group:artifact:version[+dep-group:dep-artifact:dep-version[,...]]
+#   Deps listed after `+` are written as compile-scope dependencies of that stub, so a consumer that
+#   depends on the stub also pulls them transitively.
+set -euo pipefail
+
+REPO="${1:?usage: make-stub-repo.sh <repo-dir> <group:artifact:version[+dep,...]>...}"
+shift
+if [ "$#" -eq 0 ]; then
+  echo "make-stub-repo.sh: no artifact specs given" >&2
+  exit 1
+fi
+
+rm -rf "$REPO"
+mkdir -p "$REPO"
+REPO="$(cd "$REPO" && pwd)"   # `jar` runs from an empty dir, so the output path must be absolute
+
+EMPTY="$(mktemp -d)"
+trap 'rm -rf "$EMPTY"' EXIT
+
+for spec in "$@"; do
+  coord="${spec%%+*}"
+  deps=""
+  [ "$coord" = "$spec" ] || deps="${spec#*+}"
+  IFS=: read -r group art ver <<<"$coord"
+  if [ -z "${group:-}" ] || [ -z "${art:-}" ] || [ -z "${ver:-}" ]; then
+    echo "make-stub-repo.sh: malformed spec '$spec' (want group:artifact:version[+dep,...])" >&2
+    exit 1
+  fi
+
+  dir="$REPO/${group//.//}/$art/$ver"
+  mkdir -p "$dir"
+
+  {
+    echo '<project xmlns="http://maven.apache.org/POM/4.0.0">'
+    echo '  <modelVersion>4.0.0</modelVersion>'
+    echo "  <groupId>$group</groupId>"
+    echo "  <artifactId>$art</artifactId>"
+    echo "  <version>$ver</version>"
+    echo '  <packaging>jar</packaging>'
+    if [ -n "$deps" ]; then
+      echo '  <dependencies>'
+      IFS=, read -r -a dep_list <<<"$deps"
+      for dep in "${dep_list[@]}"; do
+        IFS=: read -r dgroup dart dver <<<"$dep"
+        if [ -z "${dgroup:-}" ] || [ -z "${dart:-}" ] || [ -z "${dver:-}" ]; then
+          echo "make-stub-repo.sh: malformed dependency '$dep' in spec '$spec'" >&2
+          exit 1
+        fi
+        echo '    <dependency>'
+        echo "      <groupId>$dgroup</groupId>"
+        echo "      <artifactId>$dart</artifactId>"
+        echo "      <version>$dver</version>"
+        echo '    </dependency>'
+      done
+      echo '  </dependencies>'
+    fi
+    echo '</project>'
+  } >"$dir/$art-$ver.pom"
+
+  # empty but valid jar (jar ships with every JDK, which these fixtures already need)
+  ( cd "$EMPTY" && jar cf "$dir/$art-$ver.jar" . )
+done
+
+echo "built stub repo at $REPO"

packages/cli/src/commands/manifest/scripts/test/maven-compat/project/app/pom.xml

@@ -14,17 +14,17 @@
       <artifactId>lib</artifactId>
       <version>1.0</version>
     </dependency>
-    <!-- external prod dep (plain Java artifact, no transitive deps) -->
+    <!-- external prod dep (stub artifact from the generated repo, no transitive deps) -->
     <dependency>
-      <groupId>commons-io</groupId>
-      <artifactId>commons-io</artifactId>
-      <version>2.22.0</version>
+      <groupId>demo.ext</groupId>
+      <artifactId>tool</artifactId>
+      <version>1.0</version>
     </dependency>
-    <!-- test dep -> dev flag; pulls hamcrest transitively -->
+    <!-- test dep -> dev flag; pulls harness-core transitively -->
     <dependency>
-      <groupId>junit</groupId>
-      <artifactId>junit</artifactId>
-      <version>4.13.2</version>
+      <groupId>demo.ext</groupId>
+      <artifactId>harness</artifactId>
+      <version>1.0</version>
       <scope>test</scope>
     </dependency>
   </dependencies>

packages/cli/src/commands/manifest/scripts/test/maven-compat/project/pom.xml

@@ -13,5 +13,22 @@
     <maven.compiler.source>8</maven.compiler.source>
     <maven.compiler.target>8</maven.compiler.target>
     <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
+    <!-- smoke-test.sh overrides this with -Dstub.repo.url; the default lets a bare
+         `mvn compile` from this directory find the generated repo too. -->
+    <stub.repo.url>file://${maven.multiModuleProjectDirectory}/localrepo</stub.repo.url>
   </properties>
+  <repositories>
+    <repository>
+      <id>socket-stubs</id>
+      <url>${stub.repo.url}</url>
+      <releases>
+        <enabled>true</enabled>
+        <!-- the generator writes no .sha1 sidecars; nothing crosses a network to corrupt -->
+        <checksumPolicy>ignore</checksumPolicy>
+      </releases>
+      <snapshots>
+        <enabled>false</enabled>
+      </snapshots>
+    </repository>
+  </repositories>
 </project>