← Back to issue list

Having python3-netaddr as a stage package produces external symlink

View original Launchpad issue

Metadata

Project
snapcraft (launchpad)
Number
#1774410
Type
issue
State
open
Author
~bjornt
Labels
—
Created
Updated
Closed
—

Current evaluation

Snapcraft 2.42 could leave python3-netaddr stage-package symlinks pointing outside the snap; later normalization and regression fixes now rewrite them internally.

Suggested action: close resolved

Reason: The current craft_parts/packages/normalize.py normalizes absolute symlinks in unpacked packages, with coverage in tests/unit/packages/test_normalize.py; history also contains cea2c7372, which explicitly fixed absolute symlinks in deb packages, and later PR #3497/commit 405c57655 fixing a fix_symlink() regression. Despite the lack of maintainer discussion or a minimal reproducer, this direct code and history evidence supports closing the 2.42 report as resolved.

Evaluated by: mr-cal-bot

Impact: 55 Quick Win: 27 Complexity: 32 Confidence: 88 Actionability: 72

Issue body

I you specify python3-netaddr as a stage-package in your snapcraft.yaml, the result snap will contain symlinks that point outside the snap, i.e to /var/lib/... However, if you already have python3-netaddr installed, or specify it as a build package, the same symlinks will be relative, and point to ../../../../../var/lib/... I don't see why specifying python3-netaddr as a stage-package shouldn't work out of the box. This is with snapcraft 2.42

Evaluation history

Date Model Scores Action Summary
stealth/space-bunny-alpha
Impact: 55
Quick Win: 27
Complexity: 32
Confidence: 88
Actionability: 72
close resolved Snapcraft 2.42 could leave python3-netaddr stage-package symlinks pointing outside the snap; later normalization and regression fixes now rewrite them internally.
stealth/space-bunny-alpha
Impact: 36
Quick Win: 8
Complexity: 58
Confidence: 79
Actionability: 52
needs triage Untriaged Snapcraft 2.42 report: staging python3-netaddr produces absolute /var/lib symlinks, while installing it at build time produces relative links. No labels, maintainer response, or reproducer project.
stealth/space-bunny-alpha
Impact: 48
Quick Win: 7
Complexity: 58
Confidence: 95
Actionability: 35
close resolved python3-netaddr installed as a stage-package produced absolute symlinks to /var/lib instead of working snap-internal links, unlike installation as a build-package. Reported for Snapcraft 2.42.
qwen/qwen3.8-27b
Impact: 35
Quick Win: 21
Staleness: 95
Complexity: 40
Confidence: 55
Support Request: 10
needs triage Specifying python3-netaddr as a stage-package in snapcraft 2.42 yields symlinks pointing outside the snap (to /var/lib/...), while build-packages give relative symlinks. Unlabelled, zero comments, no maintainer activity in ~8 years.
qwen/qwen3.6-35b-a3b
Staleness: 98
Complexity: 45
Confidence: 90
Support Request: 15
close stale Reports external symlinks when staging python3-netaddr in snapcraft 2.42. No maintainer response, inactive for ~8 years, and references a severely outdated snapcraft version.
qwen/qwen3.6-35b-a3b
Staleness: 98
Complexity: 45
Confidence: 90
Support Request: 10
close stale Reports symlinks pointing outside the snap when python3-netaddr is staged. No activity for 8 years, reported against snapcraft 2.42.
qwen3.6-35b-a3b-mtp-q6
Staleness: 98
Complexity: 45
Confidence: 90
Support Request: 10
close stale Reports symlinks pointing outside the snap when python3-netaddr is used as a stage-package in snapcraft 2.42. Issue is 8 years old with no activity or maintainer response.

Update history

Date Change
created

Related work

  • Likely Fixed By: canonical/snapcraft#3497 (confidence 82%)

    The later PR fixes a regression in fix_symlink(), the same absolute-symlink normalization path implicated by this report, although the Launchpad issue does not explicitly cross-reference it.

Related issues

No related issues found above the similarity threshold.