Charm plugin can include unexpected files
Metadata
Current evaluation
Charm plugin packs all files from the project directory, unlike 2.x which filtered to known items, risking inclusion of sensitive files like .envrc. Maintainer opened it with mitigation ideas; Batalex confirmed subfolder hidden files are included. Unresolved, no fix in current code.
Suggested action: keep open
Reason: The issue is a genuine bug with security implications (Batalex notes sensitive files like .envrc can be packed), and the current _charm.py still copies the entire source directory with no filtering. It was triaged by maintainers (lengau, Batalex) with concrete mitigation ideas, but no fix has landed and the related issue #170 was closed as fixed for a different (2.x) code path, so it should remain open.
Issue body
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen/qwen3.8-27b |
Impact:
75
Quick Win:
22.5
Staleness:
55
Complexity:
70
Confidence:
70
Support Request:
5
|
keep open | Charm plugin packs all files from the project directory, unlike 2.x which filtered to known items, risking inclusion of sensitive files like .envrc. Maintainer opened it with mitigation ideas; Batalex confirmed subfolder hidden files are included. Unresolved, no fix in current code. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
80
Complexity:
65
Confidence:
85
Support Request:
10
|
needs triage | Charm plugin includes unintended files from the project root, unlike v2.x. Lacks maintainer labels or response despite being open for nearly two years and raising potential security concerns. | |
| qwen3.6-35b-a3b-mtp-q6 |
Staleness:
75
Complexity:
65
Confidence:
75
Support Request:
10
|
keep open | Charm plugin includes unintended files like hidden directories and test configs in the packed archive, deviating from v2.x behavior. Maintainers acknowledge security implications, but the issue remains unlabelled and inactive for over a year. | |
| qwen3.6-35b-a3b-mtp-q6 |
Staleness:
75
Complexity:
65
Confidence:
80
Support Request:
10
|
needs triage | Charm plugin packaging includes unintended files like hidden directories and test artifacts, diverging from v2.x behavior. Issue lacks maintainer labels or triage after over a year of inactivity. | |
| qwen3.6-35b-a3b-mtp-q6 |
Staleness:
75
Complexity:
60
Confidence:
70
Support Request:
10
|
keep open | Charm plugin bundles unintended files like subdirectory hidden files and env configs, deviating from v2.x restrictions. Maintainers are evaluating security implications and safe filtering strategies. Issue remains open and under discussion. |
Update history
No update history recorded yet.
Related work
-
Related To:
canonical/charmcraft#170
(confidence 65%)
Same concern about the charm archive including arbitrary project files; #170 was closed as fixed for the 2.x packaging path, but this issue targets the 3.x charm plugin which still lacks filtering.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #170 Stop including in the charm file whatever is in the project | charmcraft | closed | Fixed. Charmcraft now includes only mandatory files by default, preventing accidental secret exposure. Additional files require explicit configuration via charmcraft.yaml parts.prime. The fix was landed and documented. |