Processing of auth credentials provided through environment variable should be more robust
Metadata
Current evaluation
Malformed environment credentials are handled without crashing in commit a4a21e6 ("fix: catch credential decoding errors").
Resolution: closed resolved
Reason: Commit a4a21e6 added credential-decoding error handling in craft_store/auth.py, matching the maintainer's request to report malformed credentials and let authentication fail normally.
Evaluated by: mr-cal-bot
No scores available.
Issue body
Otherwise it may crash if invalid auth is provided, e.g.:
```
2021-11-16 12:38:57.240 File "/home/facundo/canonical/charmcraft/env/lib/python3.8/site-packages/craft_store/auth.py", line 101, in decode_credentials
2021-11-16 12:38:57.240 return base64.b64decode(encoded_credentials).decode()
2021-11-16 12:38:57.240 File "/usr/lib/python3.8/base64.py", line 87, in b64decode
2021-11-16 12:38:57.240 return binascii.a2b_base64(s)
2021-11-16 12:38:57.240 binascii.Error: Invalid base64-encoded string: number of data characters (5) cannot be 1 more than a multiple of 4
```
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Malformed environment credentials are handled without crashing in commit a4a21e6 ("fix: catch credential decoding errors"). | |
| stealth/space-bunny-alpha | — | closed stale | Maintainer proposed logging malformed environment credentials and returning None, but no linked PR or commit confirms a fix for the invalid-base64 crash. | |
| stealth/space-bunny-alpha | — | closed resolved | Invalid Base64 environment credentials were made more robust in craft-store PR #45 (merge commit 423589d), which returned a clear parse error instead of a raw decoding exception. | |
| qwen/qwen3.6-35b-a3b | — | — | Closed without a merged PR. Maintainers plan to gracefully handle invalid base64 credentials by logging errors and returning None to prevent crashes. | |
| qwen/qwen3.6-35b-a3b | — | — | Fixed by implementing graceful failure: invalid credentials now log an error and return None instead of crashing with a base64 decode exception. | |
| qwen/qwen3.6-35b-a3b | — | — | Fixed to gracefully handle invalid base64 credentials from environment variables. The code now logs malformed input and returns None instead of crashing, allowing authentication to fail cleanly. |
Update history
No update history recorded yet.
Related work
-
Likely Fixed By:
craft-store@a4a21e6
(confidence 96%)
The commit title and auth.py history directly match the reported invalid-base64 crash.
Related issues
No related issues found above the similarity threshold.