Add option to annotate resources, to enable vulnerability identification

Metadata

Project: charmcraft
Number: #1912
Type: issue
State: open
Author: sed-i
Labels: —
Created: 2024-09-20 03:42 AM UTC
Updated: 2025-08-15 03:17 PM UTC
Closed: —

Current evaluation

Feature request to let users annotate resource revisions (e.g. workload version) so `charmcraft resource-revisions` can map revisions to CVE-affected versions. Maintainer liked it but blocked on Charmhub API; upstream charmhub bug filed, no code yet.

Suggested action: keep open

Reason: Maintainer @lengau explicitly endorsed the idea ('Thanks for the suggestion! I like it') and filed upstream charmhub bug 2081470 to unblock it, so the issue is triaged and valid, not stale. Code inspection confirms nothing exists yet: ListResourceRevisionsCommand (charmcraft/application/commands/store.py ~2179) emits only Revision/Created at/Size/Architectures, and no 'annotation' handling exists in upload_resource or the store layer. Actionability is low because the maintainer stated there is currently 'no way to retrieve this from the charmhub developer API', so implementation is gated on upstream work plus unspecified UX (annotate-at-upload vs. a new command).

Evaluated by: mr-cal-bot

Impact: 45 Quick Win: 7 Complexity: 50 Confidence: 76 Actionability: 32

Issue body

### What needs to get done When we run `charmcraft resource-revisions`, there should be an additional column, which users could utilize to indicate workload version. ### Why it needs to get done Currently, resource revisions are opaque, and there is no way to know, without deploying, which workload version is where: ``` $ charmcraft resource-revisions prometheus-k8s prometheus-image Revision Created at Size Architectures 151 2024-09-06T19:19:58Z 512B all 150 2024-08-23T08:46:48Z 512B amd64 149 2024-07-16T14:44:50Z 512B all ``` This poses a difficulty for vulnerability identification: we need to be able to generate a list of charm revisions that are affected by a certain CVE.

Evaluation history

Date	Model	Scores	Action	Summary
2026-10-02 03:24 PM UTC	stealth/space-bunny-alpha	Impact: 45 Quick Win: 7 Complexity: 50 Confidence: 76 Actionability: 32	keep open	Feature request to let users annotate resource revisions (e.g. workload version) so `charmcraft resource-revisions` can map revisions to CVE-affected versions. Maintainer liked it but blocked on Charmhub API; upstream charmhub bug filed, no code yet.
2026-09-18 06:04 AM UTC	qwen/qwen3.6-35b-a3b	Impact: 65 Quick Win: 18 Complexity: 45 Confidence: 75 Actionability: 50	keep open	Feature request to add annotation support for resource revisions to enable vulnerability identification, blocked on charmhub API changes.
2026-09-01 12:23 AM UTC	qwen/qwen3.8-27b	Impact: 40 Quick Win: 22 Staleness: 65 Complexity: 45 Confidence: 75 Support Request: 10	keep open	Feature request to add an annotation column to charmcraft resource-revisions for workload version tracking and CVE identification. Maintainer acknowledged and filed upstream Charmhub API blocker; no progress since Sep 2024.
2026-07-22 11:47 AM UTC	qwen/qwen3.6-35b-a3b	Staleness: 60 Complexity: 20 Confidence: 85 Support Request: 0	keep open	Feature request to add workload version annotation to charmcraft resource-revisions output for vulnerability tracking. Currently blocked by charmhub API limitations; upstream issue filed. Awaiting API support.
2026-07-07 09:53 PM UTC	qwen3.6-35b-a3b-mtp-q6	Staleness: 70 Complexity: 30 Confidence: 85 Support Request: 10	keep open	Feature request to add workload version annotation to charmcraft resource-revisions output. Currently blocked pending upstream API support filed by a maintainer.
2026-07-05 03:40 AM UTC	qwen3.6-35b-a3b-mtp-q6	Staleness: 85 Complexity: 30 Confidence: 75 Support Request: 10	close stale	Feature request to annotate charmcraft resource-revisions with workload versions for CVE tracking. Currently blocked by upstream Charmhub API limitations and inactive for over 11 months.

Update history

No update history recorded yet.

Related work

Blocked By: snapstore-server#2081470 (confidence 70%)
Upstream Launchpad bug bugs.launchpad.net/snapstore-server/+bug/2081470 cited by @lengau as the blocker for exposing resource-revision metadata via the Charmhub API; ref expressed in GitHub-style form since the tracker is Launchpad.

Related issues

No related issues found above the similarity threshold.