The 'url' of 'package-repositories' can't handle PPA token from the environment variable

Bug #2007480 reported by Laider Lai
12
This bug affects 2 people
Affects Status Importance Assigned to Milestone
Snapcraft
New
Undecided
Unassigned

Bug Description

snapcraft version: 7.2.9, rev 8619

snapcraft.yaml content:
package-repositories:
  - type: apt
    architectures: [arm64]
    components: [main]
    suites: [jammy]
    key-id: <PPA ID>
    url: https://${PPA_ACCESS_TOKEN}@private-ppa.launchpadcontent.net/<team>/<project>/ubuntu

Build command:
sudo env PPA_ACCESS_TOKEN="<account>:<token>" SNAPCRAFT_BUILD_ENVIRONMENT="host" snapcraft

Problem:
Since the PPA token is sensitive information for account permission.
In general, we will not put the token content into snapcraft.yaml directly and use an environment parameter to provide the token content.
We found the 'url' of 'package-repositories' can't handle token from the environment variable.

The snapcraft create /etc/apt/sources.list.d/snapcraft-https_PPA_ACCESS_TOKEN_private_ppa_launchpadcontent..._ubuntu.sources directly with "URIs: https://${PPA_ACCESS_TOKEN}@private-ppa.launchpadcontent.net/<team>/<project>/ubuntu"

Is this expected behavior? If yes, could the team make snapcraft support to transfer url with the environment parameter? The reason is we should not put PPA token information from somebody's account and upload it to a public place.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.