← Back to issue list

Charm plugin can include unexpected files

View original Github issue

Metadata

Project
charmcraft
Number
#1900
Type
issue
State
open
Author
lengau
Labels
Created
Updated
Closed

Current evaluation

Charm plugin packs all files from the project directory, unlike 2.x which filtered to known items, risking inclusion of sensitive files like .envrc. Maintainer opened it with mitigation ideas; Batalex confirmed subfolder hidden files are included. Unresolved, no fix in current code.

Suggested action: keep open

Reason: The issue is a genuine bug with security implications (Batalex notes sensitive files like .envrc can be packed), and the current _charm.py still copies the entire source directory with no filtering. It was triaged by maintainers (lengau, Batalex) with concrete mitigation ideas, but no fix has landed and the related issue #170 was closed as fixed for a different (2.x) code path, so it should remain open.

Impact: 75 Quick Win: 22.5 Staleness: 55 Complexity: 70 Confidence: 70 Support Request: 5

Issue body

### Bug Description Currently the charm plugin includes everything from its current directory, whereas it previously (2.x) only included limited items. Changing this behaviour could be complex and breaking, because a user may accidentally depend on this behaviour to include certain files in their charm. Some ideas for minimal impact: 1. The `tests` directory from the template is almost certainly not included intentionally - this is probably fine to break if someone is depending on it. Likewise for `tox.ini` 2. The same for hidden files and directories under the root directory. (Hidden files levels down should be kept as-is). This would remove directories such as `.git`, `.tox`, etc. 3. We could warn about unexpected files in the charm. At an initial glance, this would be anything in the root directory of the charm part's output except: - `actions.yaml`, `charmcraft.yaml`, `config.yaml`, `manifest.yaml`, `metadata.yaml` - `requirements.txt` - `src/` - `lib/` - `venv/` - Files like `CONTRIBUTING`, `LICENSE`, `README`, etc. - `hooks/` - `dispatch` The previous filter: https://github.com/canonical/charmcraft/blob/hotfix/2.7/charmcraft/package.py#L227-L263 ### To Reproduce Add a THIS_SHOULD_NO_BE_INCLUDED file to an existing charm that uses the charm plugin

Evaluation history

Date Model Scores Action Summary
qwen/qwen3.8-27b
Impact: 75
Quick Win: 22.5
Staleness: 55
Complexity: 70
Confidence: 70
Support Request: 5
keep open Charm plugin packs all files from the project directory, unlike 2.x which filtered to known items, risking inclusion of sensitive files like .envrc. Maintainer opened it with mitigation ideas; Batalex confirmed subfolder hidden files are included. Unresolved, no fix in current code.
qwen/qwen3.6-35b-a3b
Staleness: 80
Complexity: 65
Confidence: 85
Support Request: 10
needs triage Charm plugin includes unintended files from the project root, unlike v2.x. Lacks maintainer labels or response despite being open for nearly two years and raising potential security concerns.
qwen3.6-35b-a3b-mtp-q6
Staleness: 75
Complexity: 65
Confidence: 75
Support Request: 10
keep open Charm plugin includes unintended files like hidden directories and test configs in the packed archive, deviating from v2.x behavior. Maintainers acknowledge security implications, but the issue remains unlabelled and inactive for over a year.
qwen3.6-35b-a3b-mtp-q6
Staleness: 75
Complexity: 65
Confidence: 80
Support Request: 10
needs triage Charm plugin packaging includes unintended files like hidden directories and test artifacts, diverging from v2.x behavior. Issue lacks maintainer labels or triage after over a year of inactivity.
qwen3.6-35b-a3b-mtp-q6
Staleness: 75
Complexity: 60
Confidence: 70
Support Request: 10
keep open Charm plugin bundles unintended files like subdirectory hidden files and env configs, deviating from v2.x restrictions. Maintainers are evaluating security implications and safe filtering strategies. Issue remains open and under discussion.

Update history

No update history recorded yet.

Related work

  • Related To: canonical/charmcraft#170 (confidence 65%)

    Same concern about the charm archive including arbitrary project files; #170 was closed as fixed for the 2.x packaging path, but this issue targets the 3.x charm plugin which still lacks filtering.

Related issues

Issue Project State Summary Similarity
#170 Stop including in the charm file whatever is in the project charmcraft closed Fixed. Charmcraft now includes only mandatory files by default, preventing accidental secret exposure. Additional files require explicit configuration via charmcraft.yaml parts.prime. The fix was landed and documented.
71%