← Back to issue list

Using token from `snapcraft export-login` as environment auth results in `craft_store.errors.CredentialsNotParseable`

View original Github issue

Metadata

Project
craft-store
Number
#265
Type
issue
State
open
Author
aywaldron
Labels
—
Created
Updated
Closed
—

Current evaluation

u1-macaroon tokens from `snapcraft export-login` fail with a generic CredentialsNotParseable when used via StoreClient; reporter misused StoreClient (needs UbuntuOneStoreClient). Maintainer converted it to a wishlist item for a clearer error message based on the 't' field.

Suggested action: keep open

Reason: The reporter confirmed the root cause ("I realized I need to use the `UbuntuOneStoreClient` instead of `StoreClient`") and lengau explicitly said "I'm going to reopen this as a wishlist item because we do have a way to make a nicer error message by looking at the value of `t` in the macaroon dictionary." The current code in craft_store/creds.py confirms the gap: unmarshal_candid_credentials() treats any dict with a 't' key as case (1)/(4) and raises a generic "Expected valid Candid credentials" without inspecting whether 't' is 'u1-macaroon'. The change is small and unit-testable (tests/unit/test_creds.py::test_mixed_creds already covers the cross-type case and would just need a message assertion), so it stays open as a valid, maintainer-acknowledged enhancement. Inactivity of ~17 months is not itself grounds for closing.

Evaluated by: mr-cal-bot

Impact: 27 Quick Win: 16 Complexity: 22 Confidence: 84 Actionability: 74

Issue body

### Bug Description I am attempting to use a token generated by `snapcraft export-login` to login to the snap store API. When I store this token in an env var and try to login with the code included in the repro steps, I get ``` craft_store.errors.CredentialsNotParseable: Credentials could not be parsed. Expected valid Candid credentials. ``` The token generated by `snapcraft export-login` is formatted like `{"t": "u1-macaroon", "v": {"r": "<string>", "d": "<string>"}}`. I get the same output when setting the env var mentioned in the help `export SNAPCRAFT_STORE_AUTH=candid`. I can see from the `craft_store` code that the `"v"` value in the token is supposed to be a string, not a dict, but can't figure out how to generate a token that has a string `"v"` value. Versions: - snapcraft: 8.5.1.post36+git0a7f753ac - craft_store: 3.2.0 - python: 3.12 - OS: Ubuntu 22.04.5 ### To Reproduce 1. On Ubuntu 22, with `snapcraft` 8.5.1 installed, run ``` export SNAPCRAFT_STORE_AUTH=candid sudo snapcraft export-login snapcraft_store_credentials ``` and login with your ubuntu one account. Inspect the contents of `snapcraft_store_credentials` with ``` cat snapcraft_store_credentials | base64 -d ``` and see that it has the structure `{"t": "u1-macaroon", "v": {"r": "<string>", "d": "<string>"}}`. 2. Store the token from `snapcraft_store_credentials` in a `SNAPCRAFT_STORE_CREDENTIALS` env var and run the following code in python 3.12 with `craft_store==3.2.0` installed. ``` from craft_store import StoreClient, endpoints store_client = StoreClient( base_url="https://dashboard.snapcraft.io", storage_base_url="https://upload.apps.ubuntu.com", endpoints=endpoints.SNAP_STORE, user_agent="test-agent", application_name="test-app", environment_auth="SNAPCRAFT_STORE_CREDENTIALS", ) store_client.whoami() ``` See exception traceback in included logs. ### part yaml ```shell ``` ### Relevant log output ```shell Traceback (most recent call last): File "/usr/local/lib/python3.12/site-packages/craft_store/creds.py", line 94, in unmarshal_candid_credentials return CandidModel.unmarshal(data).value ^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/local/lib/python3.12/site-packages/craft_store/creds.py", line 42, in unmarshal return cls.model_validate(data) ^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/local/lib/python3.12/site-packages/pydantic/main.py", line 568, in model_validate return cls.__pydantic_validator__.validate_python( ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ pydantic_core._pydantic_core.ValidationError: 2 validation errors for CandidModel t Input should be 'macaroon' [type=literal_error, input_value='u1-macaroon', input_type=str] For further information visit https://errors.pydantic.dev/2.8/v/literal_error v Input should be a valid string [type=string_type, input_value={'r': 'MDAyOWxvY2F0aW9uIG...zQXgG8mV7-uBK008LJ3igo'}, input_type=dict] For further information visit https://errors.pydantic.dev/2.8/v/string_type The above exception was the direct cause of the following exception: Traceback (most recent call last): File "<stdin>", line 1, in <module> File "/usr/local/lib/python3.12/site-packages/craft_store/base_client.py", line 199, in whoami return dict(self.request("GET", self._base_url + self._endpoints.whoami).json()) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/local/lib/python3.12/site-packages/craft_store/base_client.py", line 187, in request headers["Authorization"] = self._get_authorization_header() ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/local/lib/python3.12/site-packages/craft_store/store_client.py", line 109, in _get_authorization_header auth = creds.unmarshal_candid_credentials(self._auth.get_credentials()) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/local/lib/python3.12/site-packages/craft_store/creds.py", line 97, in unmarshal_candid_credentials raise errors.CredentialsNotParseable( craft_store.errors.CredentialsNotParseable: Credentials could not be parsed. Expected valid Candid credentials. ```

Evaluation history

Date Model Scores Action Summary
stealth/space-bunny-alpha
Impact: 27
Quick Win: 16
Complexity: 22
Confidence: 84
Actionability: 74
keep open u1-macaroon tokens from `snapcraft export-login` fail with a generic CredentialsNotParseable when used via StoreClient; reporter misused StoreClient (needs UbuntuOneStoreClient). Maintainer converted it to a wishlist item for a clearer error message based on the 't' field.
qwen/qwen3.6-35b-a3b
Impact: 25
Quick Win: 14
Complexity: 25
Confidence: 75
Actionability: 75
keep open Reporter used wrong client (StoreClient vs UbuntuOneStoreClient) for u1-macaroon tokens; maintainer reopened as wishlist to improve error message when token type 't' is 'u1-macaroon' instead of 'macaroon'.
qwen/qwen3.8-27b
Impact: 25
Quick Win: 19
Staleness: 55
Complexity: 25
Confidence: 80
Support Request: 65
keep open User used wrong client class (StoreClient instead of UbuntuOneStoreClient) for u1-macaroon credentials, self-resolved. Maintainer re-scoped as wishlist to improve the CredentialsNotParseable error message by inspecting the token type field. Not yet implemented in current code.
qwen/qwen3.6-35b-a3b
Staleness: 95
Complexity: 15
Confidence: 90
Support Request: 5
keep open User got CredentialsNotParseable when using snapcraft export-login token with StoreClient. They should use UbuntuOneStoreClient. Maintainer reopened as a wishlist to improve error messaging based on the token type field.
qwen3.6-35b-a3b-mtp-q6
Staleness: 85
Complexity: 20
Confidence: 90
Support Request: 20
keep open Maintainer reopened as a wishlist item to improve error messaging when users pass Ubuntu One credentials to the standard StoreClient. Awaiting implementation of a clearer validation message.

Update history

No update history recorded yet.

Related work

  • Related To: snapcraft (launchpad)#1834469 (confidence 40%)

    Semantic search surfaced an open snapcraft bug 'error messaging for invalid macaroon could be improved' with a similar goal of clearer credential/macaroon errors; same problem space but no explicit cross-reference in the issue.

Related issues

No related issues found above the similarity threshold.