Vendored Maven payload is written under the lowercased GAV, so mixed-case artifacts silently fall through to Central on case-sensitive file systems

[mikolalysenko]

[agent] Filed by Claude Code on behalf of Mikola Lysenko (@mikolalysenko) while adding Maven patch SBOM annotations to depscan. Reproduced with a release build of socket-patch 3efdc31d (sha256 dc5fb57f…), a stub patch API, and real Apache Maven 2.2.1 through 4.0.0-rc-7 (13 lines) on macOS arm64 / JDK 26.

Severity: high on case-sensitive file systems (Linux CI): the vendored patch is silently not consumed.

Cells: mixed-case × vendored-vendor, vendored-get, vendored-scan-detached, all 13 lines (39 cells, FAIL on
the harness's exact-case check). On darwin (case-insensitive APFS) Maven still consumes the patched jar, so the
build proof passes there.

Repro: get c0dec501-0a1b-4c2d-8e3f-000000000105 --id --mode vendored --vendor-source build on a project that
declares com.zaxxer:HikariCP:5.0.1 (the stub's view purl is the production-shaped
pkg:maven/com.zaxxer/hikaricp@5.0.1?ext=jar).

• Written: .socket/vendor/maven/c0dec501-…/com/zaxxer/hikaricp/5.0.1/hikaricp-5.0.1.{jar,pom} and
  socket-patch.vendor.json purl: pkg:maven/com.zaxxer/hikaricp@5.0.1.
• Maven requests com/zaxxer/HikariCP/5.0.1/HikariCP-5.0.1.jar from the file repository. On Linux that is a miss,
  and Maven falls through to Central's pristine jar (not run here; inferred from the path).
• The vendor_maven_local_cache_shadow advice names the wrong case too:
  -DmanualInclude=com.zaxxer:hikaricp, ~/.m2/repository/com/zaxxer/hikaricp/5.0.1.
• On darwin the CLI found the cached jar only because APFS matched ~/.m2/.../HikariCP/... case-insensitively. On
  Linux expect vendor_maven_jar_not_found instead (not run).
• Root cause is shared: depscan lowercases maven purls (parseSocketPURL/SREF, P9). But the CLI has the real
  spelling in the crawled pom and the project pom, and should build the maven2 path from those.

[mikolalysenko]

[agent] Correction from the Linux CI run (depscan run 36261631322, 13 Maven lines on ubuntu-latest): on a case-sensitive filesystem the vendored modes do not fall through to Central. They refuse with package_not_installed, because the crawler looks for the lowercased ~/.m2/repository/com/zaxxer/hikaricp/… path and doesn't find it. --vendor-source service also refuses with package_not_installed; on macOS it refuses with vendor_prebuilt_required. So Linux fails closed.

The remaining harm is on case-insensitive filesystems (macOS, Windows). There the payload is written at the lowercased path and only works because the filesystem ignores case. The committed tree then breaks for any teammate or CI job on Linux.

One more consequence of the two-step flow: after get --save-only, a refused vendor leaves the agent-mode .socket/manifest.json in place. SBOM tools that trust the manifest then report a patch that was never delivered.