Add option to annotate resources, to enable vulnerability identification

Metadata

Project: charmcraft
Number: #1912
Type: issue
State: open
Author: sed-i
Labels: —
Created: 2024-09-20 03:42 AM UTC
Updated: 2025-08-15 03:17 PM UTC
Closed: —

Current evaluation

Feature request to add an annotation column to charmcraft resource-revisions for workload version tracking and CVE identification. Maintainer acknowledged and filed upstream Charmhub API blocker; no progress since Sep 2024.

Suggested action: keep open

Reason: Maintainer @lengau acknowledged the request on 2024-09-20, stated 'I like it', and identified a concrete external blocker (Charmhub developer API lacks annotation retrieval), filing upstream bug snapstore-server#2081470. Code inspection confirms ListResourceRevisionsCommand still only outputs Revision/Created at/Size/Architectures with no annotation field. The issue is triaged, valid, and blocked on an external dependency rather than being obsolete.

Impact: 40 Quick Win: 22.0 Staleness: 65 Complexity: 45 Confidence: 75 Support Request: 10

Issue body

### What needs to get done When we run `charmcraft resource-revisions`, there should be an additional column, which users could utilize to indicate workload version. ### Why it needs to get done Currently, resource revisions are opaque, and there is no way to know, without deploying, which workload version is where: ``` $ charmcraft resource-revisions prometheus-k8s prometheus-image Revision Created at Size Architectures 151 2024-09-06T19:19:58Z 512B all 150 2024-08-23T08:46:48Z 512B amd64 149 2024-07-16T14:44:50Z 512B all ``` This poses a difficulty for vulnerability identification: we need to be able to generate a list of charm revisions that are affected by a certain CVE.

Evaluation history

Date	Model	Scores	Action	Summary
2026-09-01 12:23 AM UTC	qwen/qwen3.8-27b	Impact: 40 Quick Win: 22.0 Staleness: 65 Complexity: 45 Confidence: 75 Support Request: 10	keep open	Feature request to add an annotation column to charmcraft resource-revisions for workload version tracking and CVE identification. Maintainer acknowledged and filed upstream Charmhub API blocker; no progress since Sep 2024.
2026-07-22 11:47 AM UTC	qwen/qwen3.6-35b-a3b	Staleness: 60 Complexity: 20 Confidence: 85 Support Request: 0	keep open	Feature request to add workload version annotation to charmcraft resource-revisions output for vulnerability tracking. Currently blocked by charmhub API limitations; upstream issue filed. Awaiting API support.
2026-07-07 09:53 PM UTC	qwen3.6-35b-a3b-mtp-q6	Staleness: 70 Complexity: 30 Confidence: 85 Support Request: 10	keep open	Feature request to add workload version annotation to charmcraft resource-revisions output. Currently blocked pending upstream API support filed by a maintainer.
2026-07-05 03:40 AM UTC	qwen3.6-35b-a3b-mtp-q6	Staleness: 85 Complexity: 30 Confidence: 75 Support Request: 10	close stale	Feature request to annotate charmcraft resource-revisions with workload versions for CVE tracking. Currently blocked by upstream Charmhub API limitations and inactive for over 11 months.
2026-06-15 11:43 PM UTC	qwen3.6-35b-a3b-mtp-q6	Staleness: 80 Complexity: 25 Confidence: 85 Support Request: 5	keep open	Requests adding a workload version annotation to charmcraft resource revisions output to streamline CVE tracking. Currently blocked by charmhub API limitations; an upstream issue has been filed to unblock implementation.

Update history

No update history recorded yet.

Related issues

No related issues found above the similarity threshold.