Don't upload if unauthorized

Metadata

Project: charmcraft
Number: #709
Type: issue
State: open
Author: sed-i
Labels: —
Created: 2022-03-10 08:19 PM UTC
Updated: 2025-08-15 03:18 PM UTC
Closed: —

Current evaluation

Charmcraft upload should fail fast on unauthorized/permission errors before pushing bytes. Original 401 case fixed by PR #1052 (whoami check before upload). 2024 comment confirms publisher/collaborator permission check is still missing; no maintainer response since.

Suggested action: needs triage

Reason: PR #1052 (commit 422b8b90) added _check_authorized() before push_file, fixing the original 401-on-expired-credentials case. However, the 2024-09-20 comment from @lengau shows the permission-check aspect (publisher/collaborator) is still unaddressed, and no maintainer has responded to that re-scoping. The issue needs a maintainer to decide whether to keep it open for the narrower permission-check scope or close it and file a new issue.

Impact: 30 Quick Win: 19.5 Staleness: 60 Complexity: 35 Confidence: 75 Support Request: 10

Issue body

When I upload after my login expired, charmcraft goes through the upload and only after errors out. It would be handy if charmcraft errored out before the upload takes place. ```shell > $ charmcraft upload avalanche-k8s_ubuntu-20.04-amd64.charm Issue encountered while processing your request: [401] UNAUTHORIZED. Full execution log: '/home/ubuntu/snap/charmcraft/common/cache/charmcraft/log/charmcraft-20220310-150848.285544.log' ``` [charmcraft-20220310-150848.285544.log](https://github.com/canonical/charmcraft/files/8226949/charmcraft-20220310-150848.285544.log)

Evaluation history

Date	Model	Scores	Action	Summary
2026-09-01 12:48 AM UTC	qwen/qwen3.8-27b	Impact: 30 Quick Win: 19.5 Staleness: 60 Complexity: 35 Confidence: 75 Support Request: 10	needs triage	Charmcraft upload should fail fast on unauthorized/permission errors before pushing bytes. Original 401 case fixed by PR #1052 (whoami check before upload). 2024 comment confirms publisher/collaborator permission check is still missing; no maintainer response since.
2026-07-22 11:48 AM UTC	qwen/qwen3.6-35b-a3b	Staleness: 85 Complexity: 30 Confidence: 80 Support Request: 10	close stale	charmcraft upload fails with 401/permission errors after transferring data instead of checking auth upfront. Last updated 11 months ago with an internal Jira ticket created.
2026-07-08 12:55 AM UTC	qwen3.6-35b-a3b-mtp-q6	Staleness: 85 Complexity: 45 Confidence: 75 Support Request: 10	close stale	Feature request to add pre-upload permission checks to avoid failing after data transfer. Currently prompts for login but fails mid-upload. Inactive for 11 months with no implementation.
2026-07-05 06:04 AM UTC	qwen3.6-35b-a3b-mtp-q6	Staleness: 85 Complexity: 30 Confidence: 75 Support Request: 10	close stale	Feature request to validate publisher permissions before uploading charms. Open for over four years with no maintainer response or implementation.
2026-06-16 03:47 AM UTC	qwen3.6-35b-a3b-mtp-q6	Staleness: 75 Complexity: 20 Confidence: 75 Support Request: 10	keep open	charmcraft upload should validate auth and permissions before transferring files instead of failing mid-upload. Credentials now refresh, but pre-upload checks remain unimplemented. Internal ticket CRAFT-3416 created; awaiting development.

Update history

No update history recorded yet.

Related work

Likely Fixed By: canonical/charmcraft#1052 (confidence 85%)
PR #1052 added _check_authorized() (whoami) before push_file in _upload(), addressing the original 401-on-expired-credentials case. Does not cover the publisher/collaborator permission check noted in the 2024 comment.

Related issues

No related issues found above the similarity threshold.