Don't upload if unauthorized
Metadata
Current evaluation
Upload proceeds before checking package publisher/collaborator permission; maintainers acknowledged and filed CRAFT-3416, but current code still only checks authentication before pushing bytes.
Suggested action: keep open
Reason: Maintainer facundobatista proposed a pre-upload dry run in 2022, and lengau confirmed in 2024 that charmcraft still does not check publisher/collaborator permission before uploading; the Jira bot created internal ticket CRAFT-3416. The current upload path only calls _check_authorized()/whoami() before push_file, so the reported gap remains valid.
Evaluated by: mr-cal-bot
Impact:
40
Quick Win:
14
Complexity:
50
Confidence:
78
Actionability:
70
Issue body
When I upload after my login expired, charmcraft goes through the upload and only after errors out.
It would be handy if charmcraft errored out before the upload takes place.
```shell
> $ charmcraft upload avalanche-k8s_ubuntu-20.04-amd64.charm
Issue encountered while processing your request: [401] UNAUTHORIZED.
Full execution log: '/home/ubuntu/snap/charmcraft/common/cache/charmcraft/log/charmcraft-20220310-150848.285544.log'
```
[charmcraft-20220310-150848.285544.log](https://github.com/canonical/charmcraft/files/8226949/charmcraft-20220310-150848.285544.log)
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| ~deepseek/deepseek-pro-latest |
Impact:
40
Quick Win:
14
Complexity:
50
Confidence:
78
Actionability:
70
|
keep open | Upload proceeds before checking package publisher/collaborator permission; maintainers acknowledged and filed CRAFT-3416, but current code still only checks authentication before pushing bytes. | |
| qwen/qwen3.6-35b-a3b |
Impact:
30
Quick Win:
13
Complexity:
40
Confidence:
80
Actionability:
70
|
keep open | Request to verify store permissions before uploading to avoid wasting time on unauthorized uploads. Acknowledged by maintainers but remains unimplemented and unlabelled. | |
| qwen/qwen3.8-27b |
Impact:
30
Quick Win:
20
Staleness:
60
Complexity:
35
Confidence:
75
Support Request:
10
|
needs triage | Charmcraft upload should fail fast on unauthorized/permission errors before pushing bytes. Original 401 case fixed by PR #1052 (whoami check before upload). 2024 comment confirms publisher/collaborator permission check is still missing; no maintainer response since. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
85
Complexity:
30
Confidence:
80
Support Request:
10
|
close stale | charmcraft upload fails with 401/permission errors after transferring data instead of checking auth upfront. Last updated 11 months ago with an internal Jira ticket created. | |
| qwen3.6-35b-a3b-mtp-q6 |
Staleness:
85
Complexity:
45
Confidence:
75
Support Request:
10
|
close stale | Feature request to add pre-upload permission checks to avoid failing after data transfer. Currently prompts for login but fails mid-upload. Inactive for 11 months with no implementation. | |
| qwen3.6-35b-a3b-mtp-q6 |
Staleness:
85
Complexity:
30
Confidence:
75
Support Request:
10
|
close stale | Feature request to validate publisher permissions before uploading charms. Open for over four years with no maintainer response or implementation. |
Update history
No update history recorded yet.
Related issues
No related issues found above the similarity threshold.