Charms can import packages not installed in `venv`
Metadata
Current evaluation
Charm-plugin behavior remains unchanged; Python and Poetry plugins add venv isolation, available in Charmcraft 3.3 via #1899 (8b748f3e).
Resolution: closed not a bug
Reason: The maintainer closed the report as intended charm-plugin behavior. The recommended resolution was migrating to Python or Poetry, whose isolation protections were added by merged PR #1899 (commit 8b748f3e).
Evaluated by: mr-cal-bot
No scores available.
Issue body
Version: `2.2.0`
## Steps to reproduce
1. `git clone https://github.com/carlcsaposs-canonical/charm-bug-report.git`
2. `cd charm-bug-report/`
3. `git checkout origin/venv-boto3`
4. `charmcraft pack`
5. `juju deploy ./*.charm` on LXD
6. `juju debug-hooks charm-bug-report/0`
7. Wait for event to fire
8. `PYTHONVERBOSE=1 ./dispatch`
9. `from urllib3.contrib.pyopenssl import orig_util_SSLContext`
## Expected behavior
Charms should not be able to import packages from outside `venv`
## Actual behavior
Charms can import packages from `/usr/lib/python3/dist-packages/`
Snippet of output from last command:
```
import 'urllib3' # <_frozen_importlib_external.SourceFileLoader object at 0x7ff3c6b2db40>
# /var/lib/juju/agents/unit-charm-bug-report-0/charm/venv/urllib3/contrib/__pycache__/pyopenssl.cpython-310.pyc matches /var/lib/juju/agents/unit-charm-bug-r
eport-0/charm/venv/urllib3/contrib/pyopenssl.py
# code object from '/var/lib/juju/agents/unit-charm-bug-report-0/charm/venv/urllib3/contrib/__pycache__/pyopenssl.cpython-310.pyc'
# /usr/lib/python3/dist-packages/OpenSSL/__pycache__/__init__.cpython-310.pyc matches /usr/lib/python3/dist-packages/OpenSSL/__init__.py
# code object from '/usr/lib/python3/dist-packages/OpenSSL/__pycache__/__init__.cpython-310.pyc'
# /usr/lib/python3/dist-packages/OpenSSL/__pycache__/crypto.cpython-310.pyc matches /usr/lib/python3/dist-packages/OpenSSL/crypto.py
```
## Impact
One of mysql-operator's dependencies (`boto3`) normally uses `urllib3`'s SSLContext, but it will override that with `pyOpenSSL`'s SSLContext if it's available to import: https://github.com/boto/botocore/blob/fc30d05149c248d5e601bea37be422e97c5ad7ee/botocore/httpsession.py#L40-L50
`pyOpenSSL` is [deprecated for this cryptography usage](https://github.com/pyca/pyopenssl/blob/main/README.rst) and we do not want to use it in our charm
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed not a bug | Charm-plugin behavior remains unchanged; Python and Poetry plugins add venv isolation, available in Charmcraft 3.3 via #1899 (8b748f3e). | |
| stealth/space-bunny-alpha | — | closed superseded | The charm plugin was left unchanged; Python and Poetry plugins with venv isolation protections were added in Charmcraft 3.3 via merged PR #1899 (commit 8b748f3e). | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Closed without fixing in the charm plugin. The behavior remains unchanged, but new python and poetry plugins in charmcraft 3.3 include venv isolation protections. Migration to these plugins is recommended. | |
| qwen/qwen3.6-35b-a3b | — | — | The charm plugin will not address this venv isolation bug. Users should migrate to the upcoming python and poetry plugins in charmcraft 3.3, which properly isolate virtual environments and block system package imports. | |
| qwen/qwen3.6-35b-a3b | — | — | The charm plugin will not fix this venv isolation bug. Users should migrate to the upcoming python or poetry plugins in version 3.3, which include proper environment protections. The issue is closed as superseded by future plugin updates. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Closed. The charm plugin will not be updated to restrict system package imports. New python and poetry plugins in version 3.3 include built-in protections. Users should migrate to these updated plugins to resolve the issue. |
Update history
No update history recorded yet.
Related work
-
Likely Fixed By:
canonical/charmcraft#1899
(confidence 96%)
Merged PR added the recommended Python and Poetry plugins with venv isolation protections.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1899 feat: add Python and Poetry plugins | charmcraft | merged | Merged into main via commit 8b748f3e, adding Charmcraft-specific Python and Poetry plugins with charm-oriented venv, pip, source-copy, and binary defaults. | |
| #1140 Reconsider python package dependency management | charmcraft | closed | Legacy charm-plugin dependency redesign was superseded by dedicated Python and Poetry plugins, added in Charmcraft 3.3.0 by PR #1899 (8b748f3e). | |
| #1873 Create charmcraft-specific versions of the upstream `python` and `poetry` plugins | charmcraft | closed | Charmcraft-specific Python and Poetry plugins were added by merged PR #1899 (commit 8b748f3e), replacing the experimental work in #1840. | |
| #1781 charmcraft `3.1.1` "successfully" packs charm, but python packages are missing in the venv | charmcraft | closed | Strict-dependency packing now runs pip check and rejects inconsistent venvs; fixed in PR #1784 (fd21df24) and backported to 3.1 via PR #1794 (1ac1aa59). | |
| #1919 Charm venv shadows system python dependencies | charmcraft | open | Reported: charm plugin's PYTHONPATH=lib:venv let Juju charm venv shadow system Python packages (pydantic ImportError). lengau confirmed and pointed to new dispatch-based plugins; dispatch now sets PYTHONPATH=lib:src, so the fix has landed. |