← back to lessons

Mechanism-divergent partial port (fork ports a fix a different way, misses a sibling path)

Banked: 2026-07-14, cycle298 (Gitea v1.27.0 -> Forgejo port-lag batch, finding 298-6).

The pattern

When a lagging fork DOES port an upstream security fix, it may implement the fix via a different mechanism than upstream. If the upstream fix was applied inline per-call-site and the fork consolidates it into a single shared/config location, the fork can silently miss a sibling code path the shared location doesn't reach -> a residual gap that a naive "did they port it? yes" check would WALK.

The concrete case (298-6, pull-mirror SSRF)

The rule

When set-differencing a fork against an upstream fix, do NOT stop at "the fork has an equivalent guard." Ask: 1. By what mechanism did the fork apply it (inline per-site vs shared/central vs config)? 2. Enumerate every call site / code path the upstream fix touched (upstream applying it N times inline is a TELL that there are N distinct paths). 3. For each path, verify the fork's mechanism actually reaches it. A central/config port that covers the common path often misses a secondary path (wiki repo, LFS repo, a per-sub-resource clone, a background job) that upstream's inline approach covered by brute force.

This is the sibling of the "centralized-fix walks / per-handler-fix yields" predictor (2026-06-13), applied to PORT COMPLETENESS instead of ORIGINAL fix completeness: a fork's centralization of a port can itself create the per-path gap.

Where it lands

Generated 2026-08-08 05:45:05 UTC | auto-sync /15min