github / github/codeql

codeql pack publish fails with confusing SocketException when token lacks permission

Open
#14,104 6 comments 0 reactions 0 assignees View on GitHub
CodeQL packaging enhancement good first issue
Dominant language
CodeQL
Stars
10.1k
Forks
2.1k
Avg merge
2d 15h
Merged PRs (30d)
141

Description

When publishing a codeql pack using `codeql pack publish` and the GitHub token lacks the `write:packages` scope, the following error will be shown:

```
Aug 30, 2023 8:15:17 AM org.apache.http.impl.execchain.RetryExec execute
INFO: I/O exception (java.net.SocketException) caught when processing request to {s}->https://ghcr.io:443: An established connection was aborted by the software in your host machine
Aug 30, 2023 8:15:17 AM org.apache.http.impl.execchain.RetryExec execute
INFO: Retrying request to {s}->https://ghcr.io:443
Aug 30, 2023 8:15:17 AM org.apache.http.impl.execchain.RetryExec execute
INFO: I/O exception (java.net.SocketException) caught when processing request to {s}->https://ghcr.io:443: An established connection was aborted by the software in your host machine
Aug 30, 2023 8:15:17 AM org.apache.http.impl.execchain.RetryExec execute
INFO: Retrying request to {s}->https://ghcr.io:443
Aug 30, 2023 8:15:18 AM org.apache.http.impl.execchain.RetryExec execute
INFO: I/O exception (java.net.SocketException) caught when processing request to {s}->https://ghcr.io:443: An established connection was aborted by the software in your host machine
Aug 30, 2023 8:15:18 AM org.apache.http.impl.execchain.RetryExec execute
INFO: Retrying request to {s}->https://ghcr.io:443
A fatal error occurred: Could not upload blob asurion/asurion-java-queries@0.1.0.
```

The error `An established connection was aborted by software in your host machine` makes it seem as though a firewall or antivirus tool blocked the publish. Instead, the shown error message should mention that access was denied.

Contributor guide

Open the contributing guide

Research direction

Reproduce `codeql pack publish` with a token lacking the `write:packages` scope and compare the displayed SocketException with the requested access-denied behavior. Trace the publish command's upload error handling; done means the failure identifies insufficient package permission rather than suggesting a local firewall problem.

Written by the indexing model from the issue text.

Assessment

Tech stack
github
Domain
devtools, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.