canonical / canonical/craft-application

http auth token occasionally leaked

Open
#792 4 comments 0 reactions 0 assignees View on GitHub
Status: Triaged Type: Bug
Dominant language
Python
Stars
14
Forks
29
Avg merge
2d 3h
Merged PRs (30d)
12

Description

### Bug Description

Hello, the logging can occasionally leak http auth tokens "in the clear". While these may not have the same value as a full password or key, it'd still be nice if they weren't logged.

### To Reproduce

`snapcraft remote-build` in a CI system was reported to have this problem.

### part yaml

```shell

```

### Relevant log output

```shell
Writing objects: 100% (25/25), 1.64 GiB | 12.60 MiB/s, done.
Total 25 (delta 2), reused 3 (delta 0), pack-reused 0
error: RPC failed; HTTP 401 curl 22 The requested URL returned error: 401
send-pack: unexpected disconnect while reading sideband packet
fatal: the remote end hung up unexpectedly
Everything up-to-date
Failed to execute git command: git -C
/home/redacted/.local/share/snapcraft/remote-build/snapcraft-juju-redacted/repo push
'https://redacted:TOKEN REDACTED@git.launchpad.net/~redacted/[snip]
HEAD:master --force

Recommended resolution:
Consider checking your git configuration for settings which may cause issues.
```

Contributor guide

Open the contributing guide

Research direction

Start by tracing the snapcraft remote-build entry point and the git command output shown in the report. Reproduce or inspect the CI logging path to identify where the authenticated URL is emitted. Done means the token is no longer visible in logs while the remote-build failure remains diagnosable.

Written by the indexing model from the issue text.

Assessment

Tech stack
git, python
Domain
cli, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.