Charms can import packages not installed in `venv`
Metadata
Current evaluation
Closed without fixing in the charm plugin. The behavior remains unchanged, but new python and poetry plugins in charmcraft 3.3 include venv isolation protections. Migration to these plugins is recommended.
Suggested action: —
No scores available.
Issue body
Version: `2.2.0`
## Steps to reproduce
1. `git clone https://github.com/carlcsaposs-canonical/charm-bug-report.git`
2. `cd charm-bug-report/`
3. `git checkout origin/venv-boto3`
4. `charmcraft pack`
5. `juju deploy ./*.charm` on LXD
6. `juju debug-hooks charm-bug-report/0`
7. Wait for event to fire
8. `PYTHONVERBOSE=1 ./dispatch`
9. `from urllib3.contrib.pyopenssl import orig_util_SSLContext`
## Expected behavior
Charms should not be able to import packages from outside `venv`
## Actual behavior
Charms can import packages from `/usr/lib/python3/dist-packages/`
Snippet of output from last command:
```
import 'urllib3' # <_frozen_importlib_external.SourceFileLoader object at 0x7ff3c6b2db40>
# /var/lib/juju/agents/unit-charm-bug-report-0/charm/venv/urllib3/contrib/__pycache__/pyopenssl.cpython-310.pyc matches /var/lib/juju/agents/unit-charm-bug-r
eport-0/charm/venv/urllib3/contrib/pyopenssl.py
# code object from '/var/lib/juju/agents/unit-charm-bug-report-0/charm/venv/urllib3/contrib/__pycache__/pyopenssl.cpython-310.pyc'
# /usr/lib/python3/dist-packages/OpenSSL/__pycache__/__init__.cpython-310.pyc matches /usr/lib/python3/dist-packages/OpenSSL/__init__.py
# code object from '/usr/lib/python3/dist-packages/OpenSSL/__pycache__/__init__.cpython-310.pyc'
# /usr/lib/python3/dist-packages/OpenSSL/__pycache__/crypto.cpython-310.pyc matches /usr/lib/python3/dist-packages/OpenSSL/crypto.py
```
## Impact
One of mysql-operator's dependencies (`boto3`) normally uses `urllib3`'s SSLContext, but it will override that with `pyOpenSSL`'s SSLContext if it's available to import: https://github.com/boto/botocore/blob/fc30d05149c248d5e601bea37be422e97c5ad7ee/botocore/httpsession.py#L40-L50
`pyOpenSSL` is [deprecated for this cryptography usage](https://github.com/pyca/pyopenssl/blob/main/README.rst) and we do not want to use it in our charm
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen3.6-35b-a3b-mtp-q6 | — | — | Closed without fixing in the charm plugin. The behavior remains unchanged, but new python and poetry plugins in charmcraft 3.3 include venv isolation protections. Migration to these plugins is recommended. | |
| qwen/qwen3.6-35b-a3b | — | — | The charm plugin will not address this venv isolation bug. Users should migrate to the upcoming python and poetry plugins in charmcraft 3.3, which properly isolate virtual environments and block system package imports. | |
| qwen/qwen3.6-35b-a3b | — | — | The charm plugin will not fix this venv isolation bug. Users should migrate to the upcoming python or poetry plugins in version 3.3, which include proper environment protections. The issue is closed as superseded by future plugin updates. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Closed. The charm plugin will not be updated to restrict system package imports. New python and poetry plugins in version 3.3 include built-in protections. Users should migrate to these updated plugins to resolve the issue. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Closed without fixing in the charm plugin. The behavior persists, but upcoming python and poetry plugins in charmcraft 3.3 include venv isolation protections. Users should migrate to those plugins. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1781 charmcraft `3.1.1` "successfully" packs charm, but python packages are missing in the venv | charmcraft | closed | Missing Python packages in charmcraft 3.1.1 venvs resulted from a strict dependencies bug. The developer identified the missing pip check step, implemented a fix, and closed the report after updating validation logic. |