pimutils/vdirsyncer

Review signals: 1 connection review, 4 hardcoded secret.

Reviewed as expected for a test run: attempted writes that failed, so nothing was written; resolver address lookups that send no data.

Repository processes attempted these non-loopback connections; proxies can hide the final hostname. 104.154.89.105:443 3 attributed processes.

Gitleaks found a possible hardcoded secret; value withheld. 4 distinct locations. 4 findings.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• vdirsyncer synchronizes calendars between a local folder and a second storage: Real input produced the expected result: Syncing work/work

  Source: Vdirsyncer is a command-line tool for synchronizing calendars and addressbooks

  Input: config pair work with filesystem storages

  Expected: sync reports work/work

  Command: <guest-path> -c <guest-path> sync

  Observed: Syncing work/work

Examples

• discovery of collections for configured pairs: command completed successfully

  Source: docs/tutorial.rst

  Input: discover -c demo config

  Expected: collection work saved for pair work

  Command: <guest-path> -c <guest-path> discover

  Observed: Discovering collections for pair work work_local: - "work" work_copy: - "work" Saved for work: collections = ["work"]

• offline unit and system test suite from the Makefile ci-test target: command completed successfully

  Source: Makefile

  Input: tests/unit tests/system

  Expected: all tests pass, 2 xfail

  Command: <guest-path> -q -p no:cacheprovider tests/unit tests/system

  Observed: 194 2 28 3 98% 20, 173->exit, 223 vdirsyncer/utils.py 121 23 50 10 76% 32-39, 62, 69, 85, 88, 122, 140, 165->170, 195, 198-203, 211, 218-220 vdirsyncer/vobject.py 211 7 84 5 95% 110->113, 163, 172, 204->217, 227-228, 232-234 ---------------------------------------------------------------------------------- TOTAL 3022 835 824 101 70% 5 files skipped due to complete coverage. 150 passed, 2 xfailed in 55.17s

Cycles

• the systemd timer runs vdirsyncer sync every 15 minutes: Triggered one cycle by hand (run-once: manual invocation of the service command, no systemd in guest, no fake clock; normal trigger: systemd timer, 15 minute interval after activation): Syncing work/work

  Source: contrib/vdirsyncer.timer

  Input: config pair work

  Expected: one sync cycle reports work/work

  Command: <guest-path> -c <guest-path> sync

  Observed: Syncing work/work

Local or hosted: local

Install vdirsyncer from the source checkout and run a local calendar sync between two filesystem storages with vdirsyncer discover and vdirsyncer sync

cd <guest-path> && pwd && ls -la && id -u && python3 --version && cat README.md 2>/dev/null | head -150
cd <guest-path> && git status 2>&1 | head -3; ls <guest-path>; ls /inputs 2>&1; echo $CDP_URL
cd <guest-path> && cat README.rst
cd <guest-path> && cat config.example; ls .coldpass .builds scripts; cat Makefile | head -60
cd <guest-path> && sed -n 1,60p pyproject.toml; grep -n -i -A8 "install" docs/tutorial.rst | head -80
cd <guest-path> && grep -rn -i "pip install\|vdirsyncer --help\|vdirsyncer sync\|vdirsyncer discover" docs/*.rst | head -30; sed -n '/^Installation/,/^Configuration/p' docs/installation.rst 2>/dev/null | head -60
cd /tmp && (python3 -m venv <guest-path> 2>&1 || echo VENV_FAIL); ls <guest-path> 2>/dev/null | head; which git; dpkg -s libxml2-dev libxslt1-dev zlib1g-dev 2>&1 | grep -E "^Package|Status" 
cd <guest-path> && git init -q && git remote add origin https://github.com/pimutils/vdirsyncer && timeout 300 git fetch --depth 1 origin ceee70d1a15bab19b9691beff86d23bf072ea7dc 2>&1 | tail -3; git reset --mixed FETCH_HEAD 2>&1 | tail -2; git log --oneline -1; git status --short | head -10
cd <guest-path> && <guest-path> install -q -U pip 2>&1 | tail -3; <guest-path> install -e '.[test]' 2>&1 | tail -5
cd <guest-path> && V=<guest-path>; $V --version; $V --help; sed -n 1,80p docs/tutorial.rst | grep -v "^$" | head -70
mkdir -p <guest-path> <guest-path> && cd <guest-path> && printf 'BEGIN:VCALENDAR\r\nVERSION:2.0\r\nPRODID:-//demo//EN\r\nBEGIN:VEVENT\r\nUID:meet-001\r\nDTSTAMP:20260101T000000Z\r\nDTSTART:20260201T100000Z\r\nDTEND:20260201T110000Z\r\nSUMMARY:Planning review\r\nEND:VEVENT\r\nEND:VCALENDAR\r\n' > a/work/meet-001.ics && cat a/work/meet-001.ics && cat > config <<'EOF'
[general]
status_path = "<guest-path>"

[pair work]
a = "work_local"
b = "work_copy"
collections = ["from a"]

[storage work_local]
type = "filesystem"
path = "<guest-path>"
fileext = ".ics"

[storage work_copy]
type = "filesystem"
path = "<guest-path>"
fileext = ".ics"
EOF
<guest-path> -c <guest-path> discover 2>&1; echo rc=$?
cd <guest-path> && mkdir -p b/work && V=<guest-path> && $V -c <guest-path> discover 2>&1; echo rc=$?; $V -c <guest-path> sync 2>&1; echo rc=$?; find b -type f; ls status 2>/dev/null | head
cd <guest-path> && cat <guest-path> | head -4; grep -rn -i "cron\|--once\|systemd\|timer\|daemon" docs/*.rst contrib 2>/dev/null | head -20; ls contrib contrib/* | head
cd <guest-path> && cat contrib/vdirsyncer.timer; echo ----; cat contrib/vdirsyncer.service; echo ----; sed -n 85,100p docs/packaging.rst; cd <guest-path> && <guest-path> -c <guest-path> sync 2>&1; echo rc=$?; ls <guest-path>
cd <guest-path> && timeout 900 <guest-path> -q -p no:cacheprovider tests/unit tests/system 2>&1 | tail -15; echo rc=${PIPESTATUS[0]}
mkdir -p <guest-path> && cd <guest-path> && cat > probe.json <<'EOF'
{"kind":"cli","argv":["<guest-path>","-c","<guest-path>","sync"],"cwd":"<guest-path>","expected_text":"Syncing work/work"}
EOF
cat > claims.json <<'EOF'
[{"kind":"claim","claim":"vdirsyncer synchronizes calendars between a local folder and a second storage","source":"Vdirsyncer is a command-line tool for synchronizing calendars and addressbooks","input":"config pair work with filesystem storages","expected":"sync reports work/work","probe_kind":"cli","argv":["<guest-path>","-c","<guest-path>","sync"],"expected_text":"Syncing work/work","cwd":"<guest-path>"}]
EOF
cat > examples.json <<'EOF'
[{"kind":"example","claim":"discovery of collections for configured pairs","source":"docs/tutorial.rst","input":"discover -c demo config","expected":"collection work saved for pair work","argv":["<guest-path>","-c","<guest-path>","discover"],"cwd":"<guest-path>","expected_text":"Saved for work"},
{"kind":"example","claim":"offline unit and system test suite from the Makefile ci-test target","source":"Makefile","input":"tests/unit tests/system","expected":"all tests pass, 2 xfail","argv":["<guest-path>","-q","-p","no:cacheprovider","tests/unit","tests/system"],"cwd":"<guest-path>","expected_text":"xfailed"}]
EOF
cat > cycles.json <<'EOF'
{"detected":true,"checks":[{"claim":"the systemd timer runs vdirsyncer sync every 15 minutes","source":"contrib/vdirsyncer.timer","quote":"OnUnitActiveSec=15m","schedule":"systemd timer, 15 minute interval after activation","method":"run-once: manual invocation of the service command, no systemd in guest, no fake clock","input":"config pair work","expected":"one sync cycle reports work/work","kind":"cli","argv":["<guest-path>","-c","<guest-path>","sync"],"cwd":"<guest-path>","expected_text":"Syncing work/work"}]}
EOF
for f in probe claims examples cycles; do python3 -I -c "import json,sys;json.load(open(sys.argv[1]));print('ok',sys.argv[1])" $f.json; done
cd <guest-path> && cat > report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Install vdirsyncer from the source checkout and run a local calendar sync between two filesystem storages with vdirsyncer discover and vdirsyncer sync","operation_scope":"Local filesystem storages only (no CalDAV/CardDAV servers, no credentials, no browser). Python 3.12.3 in venv <guest-path>, pip install -e .[test]. Pinned commit ceee70d1a15bab19b9691beff86d23bf072ea7dc.","steps":["git init; git remote add origin https://github.com/pimutils/vdirsyncer; git fetch --depth 1 origin ceee70d1a15bab19b9691beff86d23bf072ea7dc; git reset --mixed FETCH_HEAD","python3 -m venv <guest-path>; <guest-path> install -e '.[test]' (docs/installation.rst manual installation)","Write config with [general] status_path, [pair work], two [storage] filesystem blocks (fileext .ics)","vdirsyncer -c <guest-path> discover","vdirsyncer -c <guest-path> sync (copied meet-001.ics into b/work)","pytest -q -p no:cacheprovider tests/unit tests/system (Makefile ci-test): 150 passed, 2 xfailed"],"deviations":["Workspace had no git metadata; ran the pinned git init/fetch/reset steps before installing so setuptools_scm could version the package.","discover prompts interactively to create a missing destination collection; pre-created demo/b/work so the run is non-interactive.","README is README.rst (not README.md); the claim source quote is taken from it.","Demo data lives in <guest-path> outside the checkout; no product source was edited."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":null}
EOF
python3 -I -c "import json;json.load(open('report.json'));print('ok')"; cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | tail -40
cd <guest-path> && python3 -I -c "
import json
p='claims.json'
c=json.load(open(p))
for x in c: x['source_file']='README.rst'
json.dump(c,open(p,'w'),indent=1)
print('ok')" && cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | tail -40