canonical / canonical/craft-application
http auth token occasionally leaked
- Dominant language
- Python
- Stars
- 14
- Forks
- 29
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 12
Description
### Bug Description
Hello, the logging can occasionally leak http auth tokens "in the clear". While these may not have the same value as a full password or key, it'd still be nice if they weren't logged.
### To Reproduce
`snapcraft remote-build` in a CI system was reported to have this problem.
### part yaml
```shell
```
### Relevant log output
```shell
Writing objects: 100% (25/25), 1.64 GiB | 12.60 MiB/s, done.
Total 25 (delta 2), reused 3 (delta 0), pack-reused 0
error: RPC failed; HTTP 401 curl 22 The requested URL returned error: 401
send-pack: unexpected disconnect while reading sideband packet
fatal: the remote end hung up unexpectedly
Everything up-to-date
Failed to execute git command: git -C
/home/redacted/.local/share/snapcraft/remote-build/snapcraft-juju-redacted/repo push
'https://redacted:TOKEN REDACTED@git.launchpad.net/~redacted/[snip]
HEAD:master --force
Recommended resolution:
Consider checking your git configuration for settings which may cause issues.
```
Contributor guide
Research direction
Start by tracing the snapcraft remote-build entry point and the git command output shown in the report. Reproduce or inspect the CI logging path to identify where the authenticated URL is emitted. Done means the token is no longer visible in logs while the remote-build failure remains diagnosable.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- git, python
- Domain
- cli, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 38/100