Charm plugin can include unexpected files
Metadata
Current evaluation
Charm plugin packs all non-ignored files from project root, potentially including sensitive files like .envrc in subdirectories. Maintainer proposes filtering or warnings; no fix yet.
Suggested action: keep open
Reason: Filed by maintainer lengau and discussed by maintainers (Batalex confirms sensitive files like .envrc in a git worktree can be packed), and code inspection shows charm_builder.py's handle_generic_paths includes all non-ignored paths. It is a valid security/privacy concern with a clear reproducer but no agreed fix approach, so it should remain open.
Evaluated by: mr-cal-bot
Impact:
60
Quick Win:
14
Complexity:
65
Confidence:
78
Actionability:
65
Issue body
### Bug Description
Currently the charm plugin includes everything from its current directory, whereas it previously (2.x) only included limited items.
Changing this behaviour could be complex and breaking, because a user may accidentally depend on this behaviour to include certain files in their charm. Some ideas for minimal impact:
1. The `tests` directory from the template is almost certainly not included intentionally - this is probably fine to break if someone is depending on it. Likewise for `tox.ini`
2. The same for hidden files and directories under the root directory. (Hidden files levels down should be kept as-is). This would remove directories such as `.git`, `.tox`, etc.
3. We could warn about unexpected files in the charm. At an initial glance, this would be anything in the root directory of the charm part's output except:
- `actions.yaml`, `charmcraft.yaml`, `config.yaml`, `manifest.yaml`, `metadata.yaml`
- `requirements.txt`
- `src/`
- `lib/`
- `venv/`
- Files like `CONTRIBUTING`, `LICENSE`, `README`, etc.
- `hooks/`
- `dispatch`
The previous filter: https://github.com/canonical/charmcraft/blob/hotfix/2.7/charmcraft/package.py#L227-L263
### To Reproduce
Add a THIS_SHOULD_NO_BE_INCLUDED file to an existing charm that uses the charm plugin
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| ~deepseek/deepseek-pro-latest |
Impact:
60
Quick Win:
14
Complexity:
65
Confidence:
78
Actionability:
65
|
keep open | Charm plugin packs all non-ignored files from project root, potentially including sensitive files like .envrc in subdirectories. Maintainer proposes filtering or warnings; no fix yet. | |
| qwen/qwen3.6-35b-a3b |
Impact:
70
Quick Win:
22
Complexity:
60
Confidence:
80
Actionability:
80
|
keep open | Charm plugin includes unexpected files (e.g., .envrc, .git, tests) in packed charms, raising security/privacy concerns. Issue is open with maintainer discussion but no fix yet. | |
| qwen/qwen3.8-27b |
Impact:
75
Quick Win:
22
Staleness:
55
Complexity:
70
Confidence:
70
Support Request:
5
|
keep open | Charm plugin packs all files from the project directory, unlike 2.x which filtered to known items, risking inclusion of sensitive files like .envrc. Maintainer opened it with mitigation ideas; Batalex confirmed subfolder hidden files are included. Unresolved, no fix in current code. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
80
Complexity:
65
Confidence:
85
Support Request:
10
|
needs triage | Charm plugin includes unintended files from the project root, unlike v2.x. Lacks maintainer labels or response despite being open for nearly two years and raising potential security concerns. | |
| qwen3.6-35b-a3b-mtp-q6 |
Staleness:
75
Complexity:
65
Confidence:
75
Support Request:
10
|
keep open | Charm plugin includes unintended files like hidden directories and test configs in the packed archive, deviating from v2.x behavior. Maintainers acknowledge security implications, but the issue remains unlabelled and inactive for over a year. | |
| qwen3.6-35b-a3b-mtp-q6 |
Staleness:
75
Complexity:
65
Confidence:
80
Support Request:
10
|
needs triage | Charm plugin packaging includes unintended files like hidden directories and test artifacts, diverging from v2.x behavior. Issue lacks maintainer labels or triage after over a year of inactivity. |
Update history
No update history recorded yet.
Related work
-
Caused By:
canonical/charmcraft#118
(confidence 70%)
Git log shows 'include everything but jujuignored' branch merged in PR #118, which likely introduced the current include-everything behavior replacing the 2.x filter.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #170 Stop including in the charm file whatever is in the project | charmcraft | closed | Charm packaging was changed to include only mandatory and recognized optional files by default; extra files must be opted in through parts.prime, preventing accidental secret inclusion. |