Stop including in the charm file whatever is in the project
Metadata
Current evaluation
Fixed. Charmcraft now includes only mandatory files by default, preventing accidental secret exposure. Additional files require explicit configuration via charmcraft.yaml parts.prime. The fix was landed and documented.
Suggested action: —
No scores available.
Issue body
We took a different path in the past (see #39), but for security reasons, we need to stop including whatever file/dirs are in the project, as it happened several times in the past that "secrets" (tokens, keys, etc) are included and published without realising it.
Before we switch back to this model, though, we need to allow the author to include specific files in the project, in case she needs some structures we're not including by default. See related #5.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen3.6-35b-a3b-mtp-q6 | — | — | Fixed. Charmcraft now includes only mandatory files by default, preventing accidental secret exposure. Additional files require explicit configuration via charmcraft.yaml parts.prime. The fix was landed and documented. | |
| qwen/qwen3.6-35b-a3b | — | — | Fixed. Charmcraft now defaults to bundling only mandatory and well-known files to prevent accidental secret exposure. Additional files must be explicitly configured via charmcraft.yaml parts.charm.prime. | |
| qwen/qwen3.6-35b-a3b | — | — | Fixed. Charmcraft now only includes mandatory and well-known files by default to prevent accidental secret exposure. Additional files must be explicitly configured in charmcraft.yaml using the parts.charm.prime directive. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Fixed. Default charm packing now excludes all project files to prevent accidental secret exposure. Only mandatory files are included by default. Users must explicitly configure additional files via the parts.charm.prime directive in charmcraft.yaml. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Fixed. Charmcraft now excludes all project files by default to prevent accidental secret exposure. Users must explicitly configure included files via charmcraft.yaml parts.prime. Mandatory and well-known optional files remain included. See Charmhub docs. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1793 fix(application): exclude files from charm | charmcraft | merged | Merged a fix excluding previous charm files and charmcraft.yaml from the output package, resolving issue #1791. Approved by two reviewers, passed CI, and implemented via a single line addition. | |
| #666 Transition from "prime" to "charm-files" for including files | charmcraft | closed | Superseded. Charmcraft 3.0 removed the custom prime-to-charm-files rewrite entirely. The prime keyword now matches standard craft-parts behavior, with migration docs added for the dump plugin. A warning detects prime usage to guide users. | |
| #1900 Charm plugin can include unexpected files | charmcraft | open | Charm plugin packs all files from the project directory, unlike 2.x which filtered to known items, risking inclusion of sensitive files like .envrc. Maintainer opened it with mitigation ideas; Batalex confirmed subfolder hidden files are included. Unresolved, no fix in current code. |