← Back to issue list

The communication with the servers is not authenticated with macaroons

View original Launchpad issue

Metadata

Project
snapcraft (launchpad)
Number
#1586910
Type
issue
State
closed
Author
~elopio
Labels
verification-done
Created
Updated
Closed

Current evaluation

Snapcraft switched store communication from OAuth to macaroon auth. Fixed by merged PR canonical/snapcraft#532 (commit f1a678a07), released in snapcraft 2.10+16.10 and verified/fixed in 2.10.1; LP bug marked verification-done.

Resolution: closed resolved

Reason: GitHub PR canonical/snapcraft#532 "Add macaroon support to login, upload and download" was merged as commit f1a678a07 and referenced by the maintainer as the fix for LP #1586910. It shipped in snapcraft 2.10 (yakkety) per the changelog, and the maintainer verified login with2FA, upload and pull of the 96boards example before marking verification-done.

Evaluated by: mr-cal-bot

No scores available.

Issue body

The snapcraft interaction with the servers is currently usingn oauth. The servers now support macaroons authentication, and we must use it for all the snapcraft commands. [Impact] * No visual impact for users, the commands are untouched. * This change improves the security of the communications with the servers. * Users who have logged in with previous versions will have to log out and log in again. [Test Case] * Run snapcraft login with and without one-time password. * Upload a snap. * Build the 96boards demo, in order to download a snap. [Regression Potential] * The existing features that interact with the servers might fail: login, upload, download.

Evaluation history

Date Model Scores Action Summary
stealth/space-bunny-alpha — closed resolved Snapcraft switched store communication from OAuth to macaroon auth. Fixed by merged PR canonical/snapcraft#532 (commit f1a678a07), released in snapcraft 2.10+16.10 and verified/fixed in 2.10.1; LP bug marked verification-done.
stealth/space-bunny-alpha — closed resolved Macaroon authentication added to snapcraft's server commands (login, upload, download) via merged PR canonical/snapcraft#532 (commit f1a678a07); shipped in snapcraft 2.10 and 2.10.1, verified on xenial.
stealth/space-bunny-alpha — closed resolved Snapcraft added macaroon authentication for login, upload, and download, replacing OAuth; merged in canonical/snapcraft#532 at f1a678a07.
qwen/qwen3.6-35b-a3b — — Resolved by implementing macaroons authentication to replace OAuth for server communication. The change improves security and requires user re-authentication. Marked as verified and closed.
qwen/qwen3.6-35b-a3b — — Implemented macaroons authentication for snapcraft server communications, replacing OAuth. The change improves security and requires user re-authentication. Closed after verification.

Update history

Date Change
created

Related work

  • Likely Fixed By: canonical/snapcraft#532 (confidence 99%)

    Merged PR adding macaroon authentication to login, upload and download; commit f1a678a07.

  • Related To: snapcraft#518 (confidence 60%)

    Companion change moving login/logout methods into the client (LP #1586504), landed in the same 2.10 release.

  • Related To: snapcraft#529 (confidence 55%)

    Fix the one-time password login (LP #1586832), related auth work in the same release.

Related issues

Issue Project State Summary Similarity
#532 Add macaroon support to login, upload and download. snapcraft merged Merged PR #532 (commit f1a678a07) added macaroon authentication to snapcraft's login, upload and download commands, closing Launchpad bug LP #1586910; shipped in snapcraft 2.10/2.10.1.
77%
#428 Login with macaroons snapcraft closed Unmerged. Author closed #428 in favour of consolidating the macaroon migration into snapcraft#472, which itself was closed unmerged in June 2016; macaroon login/upload/download finally shipped via merged PR #532 (f1a678a07) in snapcraft 2.10.
75%
#1621171 snapcraft doesn't refresh the macaroon snapcraft (launchpad) closed Merged snapcore/snapcraft PR #805 as commit 60b7ef044, adding discharge-macaroon refresh so expired credentials are renewed and authorization errors are reduced.
72%