Regression: Interacting with an on-prem store proxy fails indiscriminately

Metadata

Project: snapcraft
Number: #4533
Type: issue
State: open
Author: atomcult
Labels: —
Created: 2024-01-22 07:39 PM UTC
Updated: 2025-03-13 06:36 PM UTC
Closed: —

Current evaluation

Snapcraft 7.5.4/8.0.1 fails with 'Credentials could not be parsed. Expected valid Candid credentials' when using SNAPCRAFT_STORE_AUTH=onprem with a store proxy. No maintainer response; onprem support still exists in current code via OnPremClient.

Suggested action: needs triage

Reason: The issue has no labels, no assignee, and zero comments from any maintainer, showing no sign of triage. It reports a genuine regression in onprem store proxy interaction (a real bug, not a support request), and onprem support still exists in the current codebase (OnPremClient), so it is not clearly outdated. However, the reported versions (7.5.4/8.0.1) are old and the exact root cause is unconfirmed, so it needs maintainer assessment before any close decision.

Impact: 45 Quick Win: 20.25 Staleness: 75 Complexity: 55 Confidence: 55 Support Request: 10

Issue body

### Bug Description Both SC7 and SC8 fail when attempting to interact with a store proxy using any of the currently supported subcommands. I’ve confirmed that the macaroon file generated by `export-login` is valid by successfully building an image from the proxy with `ubuntu-image`, so the issue (based on the logs below) seems to be with `candid` login functionality. ### To Reproduce ```sh export SNAPCRAFT_ADMIN_MACAROON="$(cat store-export-ce-team-test-20240107T001605.macaroon)" export SNAPCRAFT_STORE_AUTH=onprem export STORE_DASHBOARD_URL="https://store-proxy.lxd/publishergw" export STORE_UPLOAD_URL="https://store-proxy.lxd" snapcraft export-login store-proxy.creds export SNAPCRAFT_STORE_CREDENTIALS="$(cat store-proxy.creds)" snapcraft list-revisions core22 ``` ### Environment Snapcraft 7.5.4 (rev. 10085) & Snapcraft 8.0.1 (rev. 10279) Ubuntu 23.10 x86_64 6.2.16+ Kernel ### snapcraft.yaml ```shell N/A ``` ### Relevant log output ```shell 2024-01-18 16:16:17.787 Starting Snapcraft 7.5.4 2024-01-18 16:16:17.789 Storing credentials for 'snapcraft' on 'store-proxy.lxd' in keyring 'auth MemoryKeyring'. 2024-01-18 16:16:17.789 Retrieving credentials for 'snapcraft' on 'store-proxy.lxd' from keyring 'auth MemoryKeyring'. 2024-01-18 16:16:17.789 craft-store error: Credentials could not be parsed. Expected valid Candid credentials. 2024-01-18 16:16:17.789 Full execution log: '/home/jmbrock/.local/state/snapcraft/log/snapcraft-20240118-161617.786092.log' ``` ### Additional context _No response_

Evaluation history

Date	Model	Scores	Action	Summary
2026-09-01 03:21 AM UTC	qwen/qwen3.8-27b	Impact: 45 Quick Win: 20.25 Staleness: 75 Complexity: 55 Confidence: 55 Support Request: 10	needs triage	Snapcraft 7.5.4/8.0.1 fails with 'Credentials could not be parsed. Expected valid Candid credentials' when using SNAPCRAFT_STORE_AUTH=onprem with a store proxy. No maintainer response; onprem support still exists in current code via OnPremClient.
2026-09-01 03:21 AM UTC	qwen/qwen3.8-27b	Impact: 40 Quick Win: 18.0 Staleness: 75 Complexity: 55 Confidence: 60 Support Request: 20	needs triage	Snapcraft 7.5.4/8.0.1 fails with 'Credentials could not be parsed. Expected valid Candid credentials' when using SNAPCRAFT_STORE_AUTH=onprem with a store proxy. No maintainer response; onprem support still exists in current code via OnPremClient.
2026-07-22 12:15 PM UTC	qwen/qwen3.6-35b-a3b	Staleness: 95 Complexity: 40 Confidence: 85 Support Request: 5	needs triage	Regression in Snapcraft 7.5.4/8.0.1 where on-prem store proxy interactions fail with Candid credential parsing errors. Unlabelled, no maintainer response, inactive for over a year.
2026-07-08 07:20 PM UTC	qwen3.6-35b-a3b-mtp-q6	Staleness: 90 Complexity: 40 Confidence: 85 Support Request: 10	needs triage	Snapcraft 7.5.4/8.0.1 fails to parse Candid credentials when authenticating to an on-prem store proxy. Unlabelled, no maintainer response, inactive for over a year.
2026-06-17 01:32 AM UTC	qwen3.6-35b-a3b-mtp-q6	Staleness: 95 Complexity: 25 Confidence: 85 Support Request: 5	close stale	Snapcraft 7 and 8 fail to parse Candid credentials for on-prem store proxy interactions, breaking all subcommands. Open with zero comments and 460 days of inactivity. Requires triage and assignment.

Update history

No update history recorded yet.

Related work

Related To: snapcraft#3955 (confidence 60%)
Commit 44e7644f7 'onprem store: support new credentials format (#3955)' changed onprem credential handling and is the most likely area related to this Candid credentials parsing regression.

Related issues

No related issues found above the similarity threshold.