Regression: Interacting with an on-prem store proxy fails indiscriminately
Metadata
Current evaluation
Export-login credentials for on-prem proxies were rejected as malformed Candid credentials in Snapcraft 7/8; current code explicitly bypasses Candid validation for on-prem auth and has regression coverage.
Suggested action: close resolved
Reason: Commit 7ed8b939e (canonical/snapcraft#6417) adds an explicit on-prem bypass in _has_candid_creds, and test_onprem_allows_candid_style_credentials verifies those credentials pass validation. Although the issue received no maintainer triage, the current common store-client path resolves the authentication rejection reported against 7.5.4 and 8.0.1.
Evaluated by: mr-cal-bot
Impact:
72
Quick Win:
54
Complexity:
18
Confidence:
88
Actionability:
92
Issue body
### Bug Description
Both SC7 and SC8 fail when attempting to interact with a store proxy using any of the currently supported subcommands. I’ve confirmed that the macaroon file generated by `export-login` is valid by successfully building an image from the proxy with `ubuntu-image`, so the issue (based on the logs below) seems to be with `candid` login functionality.
### To Reproduce
```sh
export SNAPCRAFT_ADMIN_MACAROON="$(cat store-export-ce-team-test-20240107T001605.macaroon)"
export SNAPCRAFT_STORE_AUTH=onprem
export STORE_DASHBOARD_URL="https://store-proxy.lxd/publishergw"
export STORE_UPLOAD_URL="https://store-proxy.lxd"
snapcraft export-login store-proxy.creds
export SNAPCRAFT_STORE_CREDENTIALS="$(cat store-proxy.creds)"
snapcraft list-revisions core22
```
### Environment
Snapcraft 7.5.4 (rev. 10085) & Snapcraft 8.0.1 (rev. 10279)
Ubuntu 23.10 x86_64
6.2.16+ Kernel
### snapcraft.yaml
```shell
N/A
```
### Relevant log output
```shell
2024-01-18 16:16:17.787 Starting Snapcraft 7.5.4
2024-01-18 16:16:17.789 Storing credentials for 'snapcraft' on 'store-proxy.lxd' in keyring 'auth MemoryKeyring'.
2024-01-18 16:16:17.789 Retrieving credentials for 'snapcraft' on 'store-proxy.lxd' from keyring 'auth MemoryKeyring'.
2024-01-18 16:16:17.789 craft-store error: Credentials could not be parsed. Expected valid Candid credentials.
2024-01-18 16:16:17.789 Full execution log: '/home/jmbrock/.local/state/snapcraft/log/snapcraft-20240118-161617.786092.log'
```
### Additional context
_No response_
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha |
Impact:
72
Quick Win:
54
Complexity:
18
Confidence:
88
Actionability:
92
|
close resolved | Export-login credentials for on-prem proxies were rejected as malformed Candid credentials in Snapcraft 7/8; current code explicitly bypasses Candid validation for on-prem auth and has regression coverage. | |
| qwen/qwen3.6-35b-a3b |
Impact:
60
Quick Win:
21
Complexity:
50
Confidence:
60
Actionability:
70
|
needs triage | On-prem store proxy fails with 'Credentials could not be parsed. Expected valid Candid credentials' error when using export-login credentials. No maintainer response. | |
| qwen/qwen3.8-27b |
Impact:
45
Quick Win:
20
Staleness:
75
Complexity:
55
Confidence:
55
Support Request:
10
|
needs triage | Snapcraft 7.5.4/8.0.1 fails with 'Credentials could not be parsed. Expected valid Candid credentials' when using SNAPCRAFT_STORE_AUTH=onprem with a store proxy. No maintainer response; onprem support still exists in current code via OnPremClient. | |
| qwen/qwen3.8-27b |
Impact:
40
Quick Win:
18
Staleness:
75
Complexity:
55
Confidence:
60
Support Request:
20
|
needs triage | Snapcraft 7.5.4/8.0.1 fails with 'Credentials could not be parsed. Expected valid Candid credentials' when using SNAPCRAFT_STORE_AUTH=onprem with a store proxy. No maintainer response; onprem support still exists in current code via OnPremClient. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
95
Complexity:
40
Confidence:
85
Support Request:
5
|
needs triage | Regression in Snapcraft 7.5.4/8.0.1 where on-prem store proxy interactions fail with Candid credential parsing errors. Unlabelled, no maintainer response, inactive for over a year. | |
| qwen3.6-35b-a3b-mtp-q6 |
Staleness:
90
Complexity:
40
Confidence:
85
Support Request:
10
|
needs triage | Snapcraft 7.5.4/8.0.1 fails to parse Candid credentials when authenticating to an on-prem store proxy. Unlabelled, no maintainer response, inactive for over a year. |
Update history
No update history recorded yet.
Related work
-
Likely Fixed By:
canonical/snapcraft#6417
(confidence 90%)
Commit 7ed8b939e adds the explicit SNAPCRAFT_STORE_AUTH=onprem exemption and regression test for candid-style credentials.
Related issues
No related issues found above the similarity threshold.