Snapcraft conflates standard PyPI packages with local plugins
Metadata
Current evaluation
Fixed by merged PR #5290: core20 local-plugin loading now uses importlib, preventing PyPI modules such as cryptography's rust package from shadowing built-in plugins.
Resolution: closed resolved
Reason: PR #5290 changed core20 local-plugin loading to use importlib, so modules in site-packages are no longer mistaken for local plugins. This directly resolves the reported collision between cryptography 44's rust module and Snapcraft's built-in Rust plugin.
Evaluated by: mr-cal-bot
No scores available.
Issue body
### Bug Description
When upgrading dependencies, it was discovered that building Snapcraft with `cryptography==44.0.0` introduced a new `rust` module to the `site-packages` directory. Doing this caused Snapcraft to attempt to use the contents of this module instead of the proper `rust` plugin when specified during packing, under the impression that it was a local plugin.
### To Reproduce
1. Add `rust` into Snapcraft's virtual environment
1. Build any snap with the Rust plugin
### Environment
24.10, Snapcraft 8.5.1
### snapcraft.yaml
```yaml
name: rust-hello
version: "1.0"
summary: simple rust application
description: build a rust app using core20
base: core20
confinement: strict
apps:
rust-hello:
command: target/hello
parts:
hello:
plugin: rust
source: src
```
### Relevant log output
```shell
https://github.com/canonical/snapcraft/actions/runs/12682069561/job/35347202604?pr=5196#step:4:1051
```
### Additional context
_No response_
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Fixed by merged PR #5290: core20 local-plugin loading now uses importlib, preventing PyPI modules such as cryptography's rust package from shadowing built-in plugins. | |
| stealth/space-bunny-alpha | — | closed resolved | Fixed in merged PR #5290: core20 local-plugin loading now uses importlib, preventing PyPI modules such as cryptography 44's rust package from shadowing built-in plugins. | |
| qwen/qwen3.6-35b-a3b | — | — | Closed and abandoned publicly, moved to internal tracking (Jira CRAFT-4003). A PyPI package named 'rust' conflicts with Snapcraft's built-in plugin, causing incorrect local plugin loading. No fix implemented. | |
| qwen/qwen3.6-35b-a3b | — | — | Closed without a fix. Internal ticket CRAFT-4003 was created to track the conflict between PyPI packages and local plugin loading. A maintainer identified the root cause in the legacy plugin loader, but the issue remains unresolved. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Closed and tracked via internal Jira ticket. Root cause identified in the plugin loader incorrectly prioritizing site-packages modules over built-in plugins. |
Update history
No update history recorded yet.
Related work
-
Likely Fixed By:
snapcraft#5290
(confidence 99%)
Merged fix for importlib-based core20 local-plugin loading.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #5290 fix(core20): use importlib for local plugins | snapcraft | merged | Merged in canonical/snapcraft#5290, changing core20 local plugin loading to use importlib; recorded in commits df498f0dc and 5edefe1ab. |