Stop including in the charm file whatever is in the project
Metadata
Current evaluation
Charm packaging was changed to include only mandatory and recognized optional files by default; extra files must be opted in through parts.prime, preventing accidental secret inclusion.
Resolution: closed resolved
Reason: Maintainer facundobatista confirmed on 2021-08-03 that the fix had already landed, documented the default allowlist behavior, and showed how to explicitly include extra files in charmcraft.yaml.
Evaluated by: mr-cal-bot
No scores available.
Issue body
We took a different path in the past (see #39), but for security reasons, we need to stop including whatever file/dirs are in the project, as it happened several times in the past that "secrets" (tokens, keys, etc) are included and published without realising it.
Before we switch back to this model, though, we need to allow the author to include specific files in the project, in case she needs some structures we're not including by default. See related #5.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Charm packaging was changed to include only mandatory and recognized optional files by default; extra files must be opted in through parts.prime, preventing accidental secret inclusion. | |
| stealth/space-bunny-alpha | — | closed resolved | Charmcraft now packages only mandatory and well-known optional files by default, preventing accidental secret exposure; additional files are opt-in through charmcraft.yaml parts.prime. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Fixed. Charmcraft now includes only mandatory files by default, preventing accidental secret exposure. Additional files require explicit configuration via charmcraft.yaml parts.prime. The fix was landed and documented. | |
| qwen/qwen3.6-35b-a3b | — | — | Fixed. Charmcraft now defaults to bundling only mandatory and well-known files to prevent accidental secret exposure. Additional files must be explicitly configured via charmcraft.yaml parts.charm.prime. | |
| qwen/qwen3.6-35b-a3b | — | — | Fixed. Charmcraft now only includes mandatory and well-known files by default to prevent accidental secret exposure. Additional files must be explicitly configured in charmcraft.yaml using the parts.charm.prime directive. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Fixed. Default charm packing now excludes all project files to prevent accidental secret exposure. Only mandatory files are included by default. Users must explicitly configure additional files via the parts.charm.prime directive in charmcraft.yaml. |
Update history
No update history recorded yet.
Related work
-
Related To:
canonical/charmcraft#5
(confidence 98%)
Configuration work allowing authors to explicitly include additional project files.
-
Related To:
canonical/charmcraft#39
(confidence 95%)
The earlier approach that included the project contents, from which this implementation departed.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1900 Charm plugin can include unexpected files | charmcraft | open | Charm plugin packs all non-ignored files from project root, potentially including sensitive files like .envrc in subdirectories. Maintainer proposes filtering or warnings; no fix yet. |