pre-flight checks not catching missing name registration

Bug #1664651 reported by Evan
18
This bug affects 3 people
Affects Status Importance Assigned to Milestone
Snapcraft
Invalid
Undecided
Unassigned
Software Center Agent
Confirmed
Undecided
Unassigned

Bug Description

In https://github.com/snapcore/snapcraft/pull/1009 pre-flight checks were added. However, snapcraft will happily upload a snap where the name hasn't been registered:

$ snapcraft push heroku_3.43.15_amd64.snap --release=edge
Uploading heroku_3.43.15_amd64.snap.
Uploading heroku_3.43.15_amd64.snap [ ] 0%
Uploading heroku_3.43.15_amd64.snap [=======================================] 100%
Sorry, try `snapcraft register heroku` before pushing again.

$ snapcraft --version
2.24

Tags: store
Revision history for this message
Leo Arias (elopio) wrote :

@Ev: that fix was released in 2.25. Can you please update snapcraft and try again?

Changed in snapcraft:
status: New → Incomplete
Revision history for this message
Sergio Schvezov (sergiusens) wrote :

I just did a debug session with snapcraft. on sending dry_run, the store just sends back this in the response object:

response.text
'{"success": true}'
response.ok
True
response.json()
{'success': True}

This used to work, marking it as a store issue.

Changed in snapcraft:
status: Incomplete → Invalid
Revision history for this message
Leo Arias (elopio) wrote :

I've just confirmed it using the latest snapcraft:

$ /home/ubuntu/workspace/canonical/snapcraft/bin/snapcraft push my-snap-name_0.1_amd64.snap --release=edge
Pushing 'my-snap-name_0.1_amd64.snap' to the store.
Uploading my-snap-name_0.1_amd64.snap [ ] 0%
Uploading my-snap-name_0.1_amd64.snap [=================================================================================================] 100%
Error while processing...
The store was unable to accept this snap. │
  - __all__: You do not have access to modify this package.

Changed in software-center-agent:
status: New → Confirmed
Revision history for this message
Kit Randel (blr) wrote :

Curiously, I'm seeing the following:

snapcraft push blr-says2_0.0.1a_amd64.snap --release=edge --debug
Starting snapcraft 2.27 from /home/kit/envs/snapcraft/lib/python3.5/site-packages/snapcraft-2.27-py3.5.egg/snapcraft.
b'Parallel unsquashfs: Using 4 processors\n1 inodes (1 blocks) to write\n\n\r[===================================================================|] 1/1 100%\n\ncreated 1 files\ncreated 2 directories\ncreated 0 symlinks\ncreated 0 devices\ncreated 0 fifos\n'
Pushing 'blr-says2_0.0.1a_amd64.snap' to the store.
Starting new HTTPS connection (1): myapps.developer.ubuntu.com
"POST /dev/api/snap-push/ HTTP/1.1" 404 None
Traceback (most recent call last):
  File "/home/kit/envs/snapcraft/bin/snapcraft", line 4, in <module>
    __import__('pkg_resources').run_script('snapcraft==2.27', 'snapcraft')
  File "/home/kit/envs/snapcraft/lib/python3.5/site-packages/pkg_resources/__init__.py", line 719, in run_script
    self.require(requires)[0].run_script(script_name, ns)
  File "/home/kit/envs/snapcraft/lib/python3.5/site-packages/pkg_resources/__init__.py", line 1504, in run_script
    exec(code, namespace, namespace)
  File "/home/kit/envs/snapcraft/lib/python3.5/site-packages/snapcraft-2.27-py3.5.egg/EGG-INFO/scripts/snapcraft", line 31, in <module>
    snapcraft.main.main()
  File "/home/kit/envs/snapcraft/lib/python3.5/site-packages/snapcraft-2.27-py3.5.egg/snapcraft/main.py", line 244, in main
    return run(args, project_options)
  File "/home/kit/envs/snapcraft/lib/python3.5/site-packages/snapcraft-2.27-py3.5.egg/snapcraft/main.py", line 288, in run
    _run_store_command(args)
  File "/home/kit/envs/snapcraft/lib/python3.5/site-packages/snapcraft-2.27-py3.5.egg/snapcraft/main.py", line 349, in _run_store_command
    snapcraft.push(args['<snap-file>'], release_channels)
  File "/home/kit/envs/snapcraft/lib/python3.5/site-packages/snapcraft-2.27-py3.5.egg/snapcraft/_store.py", line 433, in push
    store.push_precheck(snap_name)
  File "/home/kit/envs/snapcraft/lib/python3.5/site-packages/snapcraft-2.27-py3.5.egg/snapcraft/storeapi/__init__.py", line 190, in push_precheck
    self.sca.snap_push_precheck, snap_name)
  File "/home/kit/envs/snapcraft/lib/python3.5/site-packages/snapcraft-2.27-py3.5.egg/snapcraft/storeapi/__init__.py", line 169, in _refresh_if_necessary
    return func(*args, **kwargs)
  File "/home/kit/envs/snapcraft/lib/python3.5/site-packages/snapcraft-2.27-py3.5.egg/snapcraft/storeapi/__init__.py", line 522, in snap_push_precheck
    raise errors.StorePushError(data['name'], response)
snapcraft.storeapi.errors.StorePushError: You are not the publisher or allowed to push revisions for this snap. To become the publisher, run `snapcraft register blr-says2` and try to push again.

Leo Arias (elopio)
tags: added: regression
Revision history for this message
Kit Randel (blr) wrote :

Right, so the point of confusion is that the pre-flight check on the store currently on considers snap name registration, not ownership.

Revision history for this message
Leo Arias (elopio) wrote :

so, not a regression, it just never worked, that's better :)

$ snapcraft push elopio-my-snap-name_0.1_amd64.snap --release=edge
Pushing 'elopio-my-snap-name_0.1_amd64.snap' to the store.
You are not the publisher or allowed to push revisions for this snap. To become the publisher, run `snapcraft register elopio-my-snap-name` and try to push again.

Thanks Kit.

Leo Arias (elopio)
tags: added: store
removed: regression
Revision history for this message
Michael Nelson (michael.nelson) wrote :

So the preflight/dry-run check does ensure that the name of your upload is already registered (the original description was with an older snapcraft before the functionality was added).

The preflight/dry-run has never checked whether you have permission to upload to a given existing snap name (it's not as simple as ownership). The snap push handler doesn't check this without the dry-run option either - up until now it's always been checked long after the handler returns, while processing the upload - that's where the "You do not have access to modify this package." error is being generated.

It's not impossible to move that check into the handler, but it's not as simple as checking if the name is owned by the uploader (they may be a collaborator on a related application etc.)

If I've understood correctly, a more accurate title for this bug would be "pre-flight checks do not check upload permissions for a name", and it should not affect developers uploading their own snaps, but rather only those developers who try to contribute to other snaps for which they don't yet have permission. Is that correct?

Revision history for this message
Brian Murray (brian-murray) wrote :

I think there are actually two separate bugs, one regarding name registration (see also my duplicate bug) and another regarding permissions for a name.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Duplicates of this bug

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.