← Back to issue list

Implement configurable request authentication

View original Github issue

Metadata

Project
fetch-service
Number
#209
Type
issue
State
open
Author
cmatsuoka
Labels
—
Created
Updated
Closed
—

Current evaluation

Configurable per-session URL-matched authentication is implemented, including basic, macaroon, and Keystone credentials injected into matching proxied requests.

Suggested action: close resolved

Reason: The control API now accepts per-session secrets, and the proxy matches each secret's URL glob before injecting credentials into matching requests. This was delivered through merged PRs #481 (f39d929) and #483 (83d6fa6), with later secret types also present in the current code.

Evaluated by: mr-cal-bot

Impact: 65 Quick Win: 22 Complexity: 65 Confidence: 98 Actionability: 95

Issue body

### What needs to get done Allow the controller to set credentials for specific URL patterns. The Fetch Service will add these credentials to matching request URLs in a build session. ### Why it needs to get done This grants the build environment access to restricted repositories without sharing secrets with untrusted parties when building on Launchpad.

Evaluation history

Date Model Scores Action Summary
stealth/space-bunny-alpha
Impact: 65
Quick Win: 22
Complexity: 65
Confidence: 98
Actionability: 95
close resolved Configurable per-session URL-matched authentication is implemented, including basic, macaroon, and Keystone credentials injected into matching proxied requests.
stealth/space-bunny-alpha
Impact: 58
Quick Win: 11
Complexity: 65
Confidence: 87
Actionability: 56
needs triage Request authentication for build sessions remains open and unlabelled; the proposal covers per-URL credentials for restricted repositories, with only an automated CRAFT-3349 ticket notice.
stealth/space-bunny-alpha
Impact: 58
Quick Win: 12
Complexity: 56
Confidence: 74
Actionability: 48
needs triage Request per-URL-pattern credentials for Fetch Service sessions so builds can access restricted repositories without exposing controller secrets to untrusted builders.
qwen/qwen3.6-35b-a3b
Impact: 50
Quick Win: 30
Staleness: 85
Complexity: 40
Confidence: 65
Support Request: 10
needs triage Feature request to allow controller to set credentials for specific URL patterns in the Fetch Service. Unlabeled, no maintainer response, 389 days since last activity.

Update history

Date Change
created

Related work

  • Likely Fixed By: canonical/fetch-service#483 (confidence 99%)

    Merged commit 83d6fa6 implemented URL-matched basic credentials, the core capability requested by the issue.

  • Likely Fixed By: canonical/fetch-service#481 (confidence 98%)

    Merged commit f39d929 added the per-session secrets control-API scaffolding and validation.

Related issues

No related issues found above the similarity threshold.