Issue & PR triage
Loading...
Showing 44 of 44 issues
| Issue | Title | Author | Age | Action | Impact ↓ | Actionability | Quick Win | Summary |
|---|---|---|---|---|---|---|---|---|
|
fetch-service issue #209 |
Implement configurable request authentication | cmatsuoka | 780d | close resolved | 65 | 95 | 22 | Configurable per-session URL-matched authentication is implemented, including basic, macaroon, and Keystone credentials injected into matching proxied requests. |
|
fetch-service issue #354 |
Set up the proxy on a random port that's queryable from the control API | lengau | 602d | needs triage | 60 | 68 | 18 | Requests a runtime-selected proxy port exposed through the control API; it remains open and unlabeled, and current code still uses a fixed default proxy port. |
|
fetch-service issue #364 |
Inspectors contain valid URL placeholders | cmatsuoka | 591d | needs triage | 58 | 64 | 15 | Hard-coded PyPI URL matchers remain in package inspectors; the requested repository-wide placeholder audit is still open, unlabeled and awaiting maintainer triage. |
|
fetch-service issue #419 |
Missing inspectors for JARs (Maven) | Vyom-Yadav | 463d | close resolved | 58 | 72 | 26 | JAR downloads from repo1.maven.org were not recognized. JAR handling was fixed by commit ea913b3 (#535), but Java-archive MIME and noncanonical Maven host support remain unresolved concerns. |
|
fetch-service issue #329 |
Is the support complete for `rock` images? (potentially new inspector required) | Vyom-Yadav | 640d | keep open | 58 | 74 | 14 | Rockcraft's Ubuntu OCI base remains unsupported: gzip layer blobs are rejected as unknown; a maintainer says an OCI inspector is planned. |
|
fetch-service issue #653 |
Force upstream cache revalidation for mutable repository metadata | lengau | 35d | keep open | 57 | 70 | 19 | Maintainer-filed: stale proxy-cached apt InRelease can predate a newly published Packages.gz, triggering validatePackagesFile checksum failures (HTTP 403). Proposed fix: inject Cache-Control: max-age=0, must-revalidate on upstream metadata requests; approach still under discussion. |
|
fetch-service issue #304 |
Disambiguate artifacts type in case of multiple valid inspections | cmatsuoka | 696d | keep open | 55 | 66 | 10 | Fetch Service has no deterministic type when several craft inspectors approve; metadata is last-write-wins. A Sourcecraft header approach is under discussion, with a reproducer in #296. |
|
fetch-service issue #325 |
Add `*Craft.yaml` relative path to `Approved` *Craft `response-inspection` | Vyom-Yadav | 657d | keep open | 52 | 79 | 23 | Approved Craft inspections still omit the matched metadata YAML path. A maintainer agreed to add it as a first-class field, but implementation remains outstanding. |
|
fetch-service issue #156 |
Add inspector for images | jugmac00 | 832d | needs triage | 52 | 47 | 9 | Image inspection is missing, so base images appear as unrecognized artifacts in manifests even though builds succeed; requirements and technical scope remain untriaged. |
|
fetch-service issue #473 |
Inspector for DEP-11 metadata files | cmatsuoka | 384d | keep open | 50 | 50 | 12 | Maintainer-filed, triaged feature request to add a DEP-11 metadata inspector so apt-downloaded DEP-11 YAML files are identified and annotated by fetch-service. Tracked internally as FETCH-34; no implementation exists in the repo. |
|
fetch-service issue #589 |
Pass-through mode | steinbro | 220d | keep open | 50 | 38 | 2 | Proposal for a third fetch-service mode: pass-through proxying that streams packages to the builder while inspection runs async, cutting build delays. Triaged; design still being settled by maintainers. |
|
fetch-service issue #323 |
Non SPDX compliant license expressions (and license identifiers) | Vyom-Yadav | 660d | keep open | 50 | 70 | 13 | Maintainer-scoped SPDX normalization remains unimplemented: licensecheck still emits invalid and/or expressions, and a current test explicitly expects that output. |
|
fetch-service issue #296 |
Unable to disambiguate CRAFT package type with multiple CRAFT YAMLs | SuperAlpaca27 | 709d | needs triage | 48 | 64 | 12 | A repository with snapcraft.yaml, rockcraft.yaml, and sourcecraft.yaml gets three approvals, but Fetch Service emits Snapcraft metadata for a Sourcecraft package; the report remains untriaged. |
|
fetch-service issue #381 |
Incorrect metadata for `application/x.go.module.git-repo` (parsing `go.mod`) | Vyom-Yadav | 559d | needs triage | 48 | 60 | 18 | Go module Git metadata remains incorrect: the inspector manually parses go.mod and emits a short name instead of the full module path; proposed go.sum validation is unresolved. |
|
fetch-service issue #295 |
Store *CRAFT package commit in artefact metadata | SuperAlpaca27 | 709d | keep open | 46 | 72 | 17 | CRAFT inspectors still expose the YAML version instead of the checked-out Git commit; this valid provenance enhancement remains open, with a dedicated metadata field as an unsettled alternative. |
|
fetch-service issue #247 |
Use github.com/dpeckett/deb822 for deb822 parsing | tigarmo | 755d | needs triage | 46 | 61 | 9 | Maintainer request to replace several custom Debian 822 parsers with github.com/dpeckett/deb822 for multiline-field support remains unimplemented and unlabelled; only an automated Jira-sync comment exists. |
|
fetch-service issue #518 |
Merge bundled ACLs with custom ones | lengau | 349d | keep open | 45 | 82 | 24 | Custom acl.yaml still replaces the bundled ACL, forcing users to track every new destination or default change; this triaged enhancement remains open and unimplemented. |
|
fetch-service issue #353 |
Control from a unix domain socket | lengau | 602d | needs triage | 45 | 55 | 15 | Feature request: let the fetch service control API (currently TCP-only, bound to all interfaces via --control-port) also listen on a unix-domain socket when a path is given. Still open, no labels, no discussion. |
|
fetch-service issue #202 |
Add snapcraft tests | cmatsuoka | 794d | close resolved | 45 | 68 | 14 | Snap package integration tests were added and CI now runs the Spread suite through snapcraft test, although the tracking issue remains open. |
|
fetch-service pr #605 |
fix: refactor service shutdown to prevent races | cmatsuoka | 178d | needs review | 45 | 42 | 7 | Maintainer refactor of fetchctl socket, HTTP proxy and control API shutdown paths to fix hangs and races. Approved by 2 reviewers, but unit-tests (-race), snap-test (jammy) and OSV-scanner fail, and lengau's request to merge main is unanswered. |
|
fetch-service issue #373 |
Improve inspector license extraction | cmatsuoka | 577d | keep open | 45 | 58 | 11 | Maintainer task to improve license extraction: preserve valid SPDX IDs, avoid licensecheck false positives, and normalize license names. Still open, tracked as CRAFT-4413; may also address #323. |
|
fetch-service issue #401 |
Add format inspection smoke tests | cmatsuoka | 494d | needs triage | 45 | 50 | 11 | Partially implemented: the repository has Spread smoke-test tasks for several inspectors, but the issue remains unlabelled and untriaged, with no evidence all supported artifact formats are covered. |
|
fetch-service issue #424 |
Have inspectors explicitly declare dependencies on other inspectors | upils | 456d | keep open | 45 | 62 | 6 | Refactor request to make inspectors declare dependencies and have inspectors.New() topologically order them, replacing fragile hard-coded insList ordering; still open, unlabelled, no comments, idle ~413 days. |
|
fetch-service issue #225 |
Add GitHub workflow that builds and tests the fetch-operator charm | lengau | 766d | needs triage | 42 | 58 | 11 | Maintainer task (lengau) to add a CI workflow that builds the fetch-operator charm and runs `charmcraft test` with charmcraft.yaml pinned to the current fetch-service commit; still unimplemented. |
|
fetch-service pr #666 |
fix(deps): update module github.com/klauspost/compress to v1.20.3 | renovate | 16d | needs review | 40 | 60 | 22 | Renovate PR updating github.com/klauspost/compress from v1.20.1 to v1.20.3, including security fixes. Awaiting maintainer review with some CI checks pending. |
|
fetch-service issue #96 |
Missing metadata attributes in certain file formats | cmatsuoka | 910d | needs triage | 40 | 42 | 7 | Maintainer-filed backlog issue: ancillary artefacts (apt Packages, git protocol, snap API, pip index) report empty name/version/vendor in session metadata. Unlabelled, no comments or precise reproducer after 883 days; needs scoping. |
|
fetch-service issue #495 |
Linters: enable gocyclo, errcheck and gosec | upils | 366d | keep open | 40 | 65 | 8 | Enhancement to enable gocyclo, errcheck and gosec in .github/.golangci.yaml and fix the resulting findings. Maintainer-authored, Triaged, tracked internally as FETCH-63; attempt PR #545 was closed unmerged. |
|
fetch-service pr #501 |
draft: reorder some lxd calls to trigger launchpad behavior | tigarmo | 359d | keep open | 40 | 30 | 8 | Reorders LXD requests to trigger Launchpad behavior. The draft has been inactive for 332 days, has no reviews, and has a failing OSV-scanner check while core CI and tests pass. |
|
fetch-service issue #388 |
fetchctl tests fail in Fedora | cmatsuoka | 538d | needs triage | 40 | 78 | 14 | Fedora 40 spread basic-inspection fails because fetch-service.fetchctl is unavailable; Fedora remains disabled in spread.yaml pending investigation. |
|
fetch-service issue #231 |
Fetch-service snap doesn't start after refresh | simonepelosi | 763d | close resolved | 35 | 82 | 25 | Fetch-service snap required manual `systemctl start snap.fetch-service.fetchd.service` after refresh; fixed in snap/snapcraft.yaml by setting refresh-mode: endure (commit bdbb27d, PR #273). |
|
fetch-service issue #221 |
create a cache for the unpacked git repositories | dariuszd21 | 770d | close resolved | 35 | 80 | 15 | Request to cache/reuse unpacked git pack repositories so inspectors share one copy instead of unpacking per-inspector; addressed by PR #290 (commit 2ca0dfe) which unpacks once into CacheDir and shares via git-checkout-path annotation |
|
fetch-service issue #662 |
Flaky TestServerListening in control due to unclosed servers and timing race | lengau | 30d | needs triage | 32 | 86 | 23 | control.TestServerListening flakes in CI: hardcoded port 18111 reused by three tests, servers never Stop()ed, and a 500ms sleep instead of waiting on ctl2.Dying(). Proposed fix with root cause analysis. |
|
fetch-service issue #284 |
Create a CLI tool to inspect a specific file | lengau | 731d | keep open | 30 | 58 | 10 | Maintainer-authored request for a path-based file-inspection CLI remains open; maintainers said it would shorten inspector development cycles and linked it to internal ticket CRAFT-3965. |
|
fetch-service pr #447 |
test: reproducer for security/archive.ubuntu issue | tigarmo | 434d | close superseded | 30 | 8 | 2 | Adds a reproducer for APT translation requests to security/archive Ubuntu repositories. The behavior was implemented by merged #548; this 406-day-old PR remains unreviewed with Noble and Jammy snap tests failing. |
|
fetch-service issue #257 |
Document how to generate captures for test data | lengau | 750d | needs triage | 30 | 65 | 16 | Open, untriaged maintainer doc request: add a how-to page describing how to generate pcap captures (tshark + SSLKEYLOGFILE git clone) used as fetch-service test data. No such docs exist yet. |
|
fetch-service pr #660 |
fix(deps): update module github.com/elazarl/goproxy to v1.9.2 | lengau | 30d | needs review | 30 | 70 | 19 | Updates goproxy to v1.9.2 and adjusts proxy_test.go for normalized req.URL.Host behavior. Approved by 1 reviewer; most CI passing, OSV-scanner failing, snap-tests pending. |
|
fetch-service issue #389 |
Update snapcraft test to stable in CI tests | cmatsuoka | 538d | needs triage | 28 | 50 | 11 | CI spread tests still install snapcraft from latest/edge; maintainer wants the stable channel used in tests once craft-test is published there. Still open, unlabelled, no discussion. |
|
fetch-service issue #36 |
SNAP: Find a better way to handle perl dependencies | lengau | 1001d | keep open | 28 | 38 | 5 | Maintainer TODO from the fetch-service snap PR review: shrink/simplify the hardcoded PERLLIB env var in snap/snapcraft.yaml (still present at current HEAD, needed for the bundled licensecheck), no discussion or proposal yet. |
|
fetch-service pr #383 |
test(unit): add git object that fails during clone | dariuszd21 | 553d | close stale | 18 | 15 | 2 | Adds a malformed Git-object fixture and clone-test assertion; approved but stale, with one unresolved comment and unit-tests and snap-build failing. |
|
fetch-service pr #668 |
fix(deps): update module github.com/gabriel-vasile/mimetype to v1.4.16 | renovate | 12d | needs review | 15 | 50 | 7 | Renovate-generated dependency update bumping github.com/gabriel-vasile/mimetype from v1.4.15 to v1.4.16. Minimal diff (+3/-1 lines). OSV-scanner CI check is failing; other checks pending. No reviewers assigned yet. |
|
fetch-service issue #282 |
ANNOUNCEMENT: SNAP CHANNELS | lengau | 731d | close not a bug | 10 | 15 | 1 | Maintainer announcement mapping branches to snap channels: main publishes to edge, while the feature/launchpad-integration branch was merged into main and retired. Informational only; no code change outstanding. |
|
fetch-service pr #558 |
chore(deps): update go module directive to v1.27.3 | renovate | 286d | keep open | 10 | 20 | 2 | Renovate PR updating Go from 1.25.11 to 1.27.3 and actions/go-versions from 1.25 to 1.27. Open 281 days with failing CI (snap-test noble, OSV-scanner) and no reviewer activity. |
|
fetch-service pr #430 |
docs: docstrings for ./inspectors/common | sergiusens | 452d | needs review | 10 | 55 | 5 | Docs-only PR adding Go docstrings to inspectors/common/common.go (+132/-93, one file) by a maintainer. All CI checks pass, zero review comments, but untouched for 424 days and the file has since been refactored several times. |
|
fetch-service pr #669 |
build(Makefile): add lint-code target | LoweRAM | 4d | ? | ? | ? |