Rockcraft ignores configured staging Pro contract URL when building with `--pro=fips-updates`

Metadata

Project: rockcraft
Number: #910
Type: issue
State: open
Author: bschimke95
Labels: —
Created: 2025-07-01 10:24 AM UTC
Updated: 2025-07-14 02:51 PM UTC
Closed: —

Current evaluation

Rockcraft ignores the staging Pro contract URL when building with --pro=fips-updates. A fix landed in craft-providers PR #776 and was pulled into rockcraft via craft-providers 3.7.1.

Suggested action: close resolved

Reason: Maintainer @clay-lake said a fix was ready in craft-providers; git log shows commit c46962d1 'fix(pro-sources): Inherit Host's contract_url (#776)', and rockcraft's pyproject/uv.lock now require craft-providers>=3.7.1 via #1281, so the codebase contains the fix.

Evaluated by: mr-cal-bot

Impact: 40 Quick Win: 27 Complexity: 20 Confidence: 85 Actionability: 85

Issue body

### Bug Description I'm attempting to build a Rock with Ubuntu Pro features (`fips-updates`) enabled, following the guidance from [this tutorial](https://discourse.ubuntu.com/t/build-rocks-with-ubuntu-pro-services/57578), using a Multipass VM that has Ubuntu Pro enabled and uses `rockcraft` on `/edge/pro-sources`. However, when running: ```bash sudo rockcraft pack --pro=fips-updates ``` I receive the following error: ``` Request error when trying to retrieve the guest token. Full execution log: '/root/.local/state/rockcraft/log/rockcraft-20250701-093309.982978.log' ``` The logs indicate that Rockcraft attempts to contact the **production** Ubuntu Pro contract server: ``` requests.exceptions.HTTPError: 401 Client Error: for url: https://contracts.canonical.com/v1/contracts/... ``` This is despite the system being explicitly configured to use the **staging** Pro contract server, as set in `/etc/ubuntu-advantage/uaclient.conf`: ```yaml contract_url: https://contracts.staging.canonical.com ``` This configuration works with other Pro tooling on the system. However, it appears that Rockcraft does **not respect** the staging URL set in the system config and instead defaults to the production URL when attempting to retrieve a guest token. **Expected behavior**: Rockcraft should honor the configured contract URL in `/etc/ubuntu-advantage/uaclient.conf` when requesting a guest token for Ubuntu Pro features. **Impact**: This prevents building Rocks with Pro features in internal CI environments that are intentionally pointed to staging infrastructure to avoid overloading production servers. ### To Reproduce 1. Configure the host system with a staging Pro token, set the contract URL to `https://contracts.staging.canonical.com` in `/etc/ubuntu-advantage/uaclient.conf` and use the `edge/pro-sources` branch of Rockcraft. 2. Run `sudo rockcraft pack --pro=fips-updates`. 3. Observe the failure due to the guest token being requested from the production endpoint. ### Environment Should not be relevant but tested on: * Ubuntu 22.04 inside a Ubuntu Pro-enabled 22.04 Multipass VM ### rockcraft.yaml ```yaml name: metallb-controller summary: Rock for the Metallb controller. description: > This rock is a drop in replacement for the quay.io/metallb/controller image. version: v0.14.9 license: Apache-2.0 base: bare build-base: ubuntu@22.04 platforms: amd64: arm64: entrypoint-service: controller services: controller: command: /controller [ -h ] override: replace startup: enabled parts: add-base-files: plugin: nil stage-packages: # Original Dockerfile uses gcr.io/distroless/static:latest as a base. # This image contains the following: # https://github.com/GoogleContainerTools/distroless/blob/1533e54a73805ec13fe0cc68218fc7a215a0a6f7/base/README.md - ca-certificates - tzdata - base-passwd - bash - coreutils # Can't have stage packages and stage slices together, apparently. add-base-slices: plugin: nil stage-packages: - base-files_tmp build-deps: plugin: nil build-snaps: - go/1.22/stable controller: after: [build-deps] plugin: go source-type: git source: https://github.com/metallb/metallb source-tag: v0.14.9 source-depth: 1 override-build: | GIT_COMMIT=`git rev-parse HEAD` # We'll use the tag name. GIT_BRANCH=`git describe --tags --abbrev=0` CGO_ENABLED=0 go build -v -o $CRAFT_PART_INSTALL/controller \ -ldflags "-X 'go.universe.tf/metallb/internal/version.gitCommit=${GIT_COMMIT}' -X 'go.universe.tf/metallb/internal/version.gitBranch=${GIT_BRANCH}'" \ ./controller cp $CRAFT_PART_BUILD/LICENSE $CRAFT_PART_INSTALL/ ``` ### Relevant log output ```shell 2025-07-01 09:33:16.309 Executing on host: lxc --project rockcraft config device show local:rockcraft-metallb-controller-amd64-4 2025-07-01 09:33:16.377 Executing on host: lxc --project rockcraft config device remove local:rockcraft-metallb-controller-amd64-4 disk-/root/project 2025-07-01 09:33:16.481 Executing on host: lxc --project rockcraft stop local:rockcraft-metallb-controller-amd64-4 2025-07-01 09:33:20.548 Request error when trying to retrieve the guest token. 2025-07-01 09:33:20.551 Traceback (most recent call last): 2025-07-01 09:33:20.551 File "/snap/rockcraft/3384/lib/python3.12/site-packages/craft_providers/pro.py", line 78, in request_pro_guest_token 2025-07-01 09:33:20.551 response.raise_for_status() 2025-07-01 09:33:20.551 File "/snap/rockcraft/3384/lib/python3.12/site-packages/requests/models.py", line 1024, in raise_for_status 2025-07-01 09:33:20.551 raise HTTPError(http_error_msg, response=self) 2025-07-01 09:33:20.551 requests.exceptions.HTTPError: 401 Client Error: for url: https://contracts.canonical.com/v1/contracts/cAEU6p_D3E5Wcb48FAZqZUn7KzXc5SKvuHGUnopS36EQ/context/machines/e523c43785514bcd871331d6c9be6228/guest-token 2025-07-01 09:33:20.551 2025-07-01 09:33:20.551 During handling of the above exception, another exception occurred: 2025-07-01 09:33:20.551 Traceback (most recent call last): 2025-07-01 09:33:20.551 File "/snap/rockcraft/3384/lib/python3.12/site-packages/craft_application/application.py", line 758, in run 2025-07-01 09:33:20.551 return_code = self._run_inner() 2025-07-01 09:33:20.551 ^^^^^^^^^^^^^^^^^ 2025-07-01 09:33:20.551 File "/snap/rockcraft/3384/lib/python3.12/site-packages/craft_application/application.py", line 742, in _run_inner 2025-07-01 09:33:20.551 self.run_managed(platform, build_for) 2025-07-01 09:33:20.551 File "/snap/rockcraft/3384/lib/python3.12/site-packages/craft_application/application.py", line 506, in run_managed 2025-07-01 09:33:20.551 self._configure_instance_with_pro(instance) 2025-07-01 09:33:20.551 File "/snap/rockcraft/3384/lib/python3.12/site-packages/craft_application/application.py", line 456, in _configure_instance_with_pro 2025-07-01 09:33:20.551 instance.attach_pro_subscription() # type: ignore # noqa: PGH003 2025-07-01 09:33:20.551 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 2025-07-01 09:33:20.551 File "/snap/rockcraft/3384/lib/python3.12/site-packages/craft_providers/lxd/lxd_instance.py", line 639, in attach_pro_subscription 2025-07-01 09:33:20.551 pro_token=pro.request_pro_guest_token(), 2025-07-01 09:33:20.551 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 2025-07-01 09:33:20.551 File "/snap/rockcraft/3384/lib/python3.12/site-packages/craft_providers/pro.py", line 92, in request_pro_guest_token 2025-07-01 09:33:20.551 raise GuestTokenError( 2025-07-01 09:33:20.551 craft_providers.errors.GuestTokenError: Request error when trying to retrieve the guest token. 2025-07-01 09:33:20.551 Full execution log: '/root/.local/state/rockcraft/log/rockcraft-20250701-093309.982978.log' ```

Evaluation history

Date	Model	Scores	Action	Summary
2026-10-02 03:44 PM UTC	~deepseek/deepseek-pro-latest	Impact: 40 Quick Win: 27 Complexity: 20 Confidence: 85 Actionability: 85	close resolved	Rockcraft ignores the staging Pro contract URL when building with --pro=fips-updates. A fix landed in craft-providers PR #776 and was pulled into rockcraft via craft-providers 3.7.1.
2026-09-18 04:02 PM UTC	qwen/qwen3.6-35b-a3b	Impact: 70 Quick Win: 39 Complexity: 30 Confidence: 90 Actionability: 80	close resolved	Rockcraft ignores staging contract URL when building with --pro=fips-updates. Fix implemented in craft-providers PR #776 (commit c46962d).
2026-09-01 01:10 AM UTC	qwen/qwen3.8-27b	Impact: 50 Quick Win: 30 Staleness: 55 Complexity: 40 Confidence: 80 Support Request: 5	keep open	Rockcraft ignores the staging Pro contract URL from /etc/ubuntu-advantage/uaclient.conf when building with --pro=fips-updates, hitting production and failing with 401. Triaged by clay-lake, who has a fix ready in craft-providers and will trigger a new build once merged.
2026-07-22 12:08 PM UTC	qwen/qwen3.6-35b-a3b	Staleness: 65 Complexity: 30 Confidence: 90 Support Request: 5	keep open	Rockcraft ignores the staging Ubuntu Pro contract URL when building with --pro=fips-updates. A maintainer has a fix ready in craft-providers and is awaiting its merge before triggering a new build.
2026-07-08 04:22 AM UTC	qwen3.6-35b-a3b-mtp-q6	Staleness: 45 Complexity: 30 Confidence: 95 Support Request: 10	keep open	Rockcraft ignores the staging Ubuntu Pro contract URL from uaclient.conf when using --pro=fips-updates, causing guest token retrieval failures. A maintainer has a fix ready in craft-providers and is awaiting its merge.
2026-07-05 07:57 AM UTC	qwen3.6-35b-a3b-mtp-q6	Staleness: 90 Complexity: 40 Confidence: 85 Support Request: 10	keep open	Bug where Rockcraft ignores the configured staging Ubuntu Pro contract URL during --pro=fips-updates builds. Maintainer triaged and identified a fix in craft-providers, but has been inactive for over a year awaiting dependency updates.

Update history

No update history recorded yet.

Related work

Likely Fixed By: canonical/craft-providers#776 (confidence 90%)
Commit c46962d1 in craft-providers adds inheritance of the host's contract_url.
Likely Fixed By: canonical/rockcraft#1281 (confidence 80%)
Rockcraft dependency update to craft-providers 3.7.1 pulls in the craft-providers fix.

Related issues

No related issues found above the similarity threshold.