importing assertions in snapd: no errors reported

[Sandro]

Importing assertion with wrong information in snapd using the /run/snapd.socket interface, no errors are reported, the reply is always "OK" and the assertion is ignored.

Wrong assertions can be done, for example, using `make-system-user` but failing to sign the assertion, using wrong ID, putting wrong information in the command line,... an empty string is considered "OK" as well.

```
curl -sS --unix-socket /run/snapd.socket http://localhost/v2/assertions -X POST -H "Content-Type: application/x.ubuntu.assertion" -H "Content-type: text/x-yaml" --data-binary @filewrong.assert
{"type":"sync","status-code":200,"status":"OK","result":null}
```

Sometimes (for example using wrong -b ID), snapd complains in the system log, but still not in the request.

Only with data in wrong format, i.e. 'HELLO', it complains with "cannot decode request body into assertions: unexpected EOF".

My expectation is that the request should fail with errors and complains about wrong information.

[Paweł Stołowski (stolowski)]

Indeed, something seems off, we do have error handling (and returning to the client) in the code, but it's not catching some problems.

For example, using the curl reproducer that you provided I can see we're hitting 'if err == io.EOF ...' early in AddStream(r io.Reader) in assertions code and simply end the processing with no errors; we should probably check for valid non-empty body.

Thanks for reporting.

[Paweł Stołowski (stolowski)]

Ok, I think I was too quick, at the moment I can only confirm an empty body (invalid file as in your curl example) is a potential issue, and we probably should not report OK for it.

The rest is unclear and looks like there might be issues with make-system-user. We will need more details. Could you please provide precise steps that show a problem in snapd and snapd API? Please note, if there is a problem with make-system-user not validating inputs correctly, then it should be reported to the maintainer/developer of that snap.