pre-flight checks not catching missing name registration

[Evan]

In https://github.com/snapcore/snapcraft/pull/1009 pre-flight checks were added. However, snapcraft will happily upload a snap where the name hasn't been registered:

$ snapcraft push heroku_3.43.15_amd64.snap --release=edge
Uploading heroku_3.43.15_amd64.snap.
Uploading heroku_3.43.15_amd64.snap [ ] 0%
Uploading heroku_3.43.15_amd64.snap [=======================================] 100%
Sorry, try `snapcraft register heroku` before pushing again.

$ snapcraft --version
2.24

[Leo Arias (elopio)]

@Ev: that fix was released in 2.25. Can you please update snapcraft and try again?

[Sergio Schvezov (sergiusens)]

I just did a debug session with snapcraft. on sending dry_run, the store just sends back this in the response object:

response.text
'{"success": true}'
response.ok
True
response.json()
{'success': True}

This used to work, marking it as a store issue.

[Leo Arias (elopio)]

I've just confirmed it using the latest snapcraft:

$ /home/ubuntu/workspace/canonical/snapcraft/bin/snapcraft push my-snap-name_0.1_amd64.snap --release=edge
Pushing 'my-snap-name_0.1_amd64.snap' to the store.
Uploading my-snap-name_0.1_amd64.snap [ ] 0%
Uploading my-snap-name_0.1_amd64.snap [=================================================================================================] 100%
Error while processing...
The store was unable to accept this snap. │
  - __all__: You do not have access to modify this package.

[Kit Randel (blr)]

Curiously, I'm seeing the following:

snapcraft push blr-says2_0.0.1a_amd64.snap --release=edge --debug
Starting snapcraft 2.27 from /home/kit/envs/snapcraft/lib/python3.5/site-packages/snapcraft-2.27-py3.5.egg/snapcraft.
b'Parallel unsquashfs: Using 4 processors\n1 inodes (1 blocks) to write\n\n\r[===================================================================|] 1/1 100%\n\ncreated 1 files\ncreated 2 directories\ncreated 0 symlinks\ncreated 0 devices\ncreated 0 fifos\n'
Pushing 'blr-says2_0.0.1a_amd64.snap' to the store.
Starting new HTTPS connection (1): myapps.developer.ubuntu.com
"POST /dev/api/snap-push/ HTTP/1.1" 404 None
Traceback (most recent call last):
  File "/home/kit/envs/snapcraft/bin/snapcraft", line 4, in <module>
    __import__('pkg_resources').run_script('snapcraft==2.27', 'snapcraft')
  File "/home/kit/envs/snapcraft/lib/python3.5/site-packages/pkg_resources/__init__.py", line 719, in run_script
    self.require(requires)[0].run_script(script_name, ns)
  File "/home/kit/envs/snapcraft/lib/python3.5/site-packages/pkg_resources/__init__.py", line 1504, in run_script
    exec(code, namespace, namespace)
  File "/home/kit/envs/snapcraft/lib/python3.5/site-packages/snapcraft-2.27-py3.5.egg/EGG-INFO/scripts/snapcraft", line 31, in <module>
    snapcraft.main.main()
  File "/home/kit/envs/snapcraft/lib/python3.5/site-packages/snapcraft-2.27-py3.5.egg/snapcraft/main.py", line 244, in main
    return run(args, project_options)
  File "/home/kit/envs/snapcraft/lib/python3.5/site-packages/snapcraft-2.27-py3.5.egg/snapcraft/main.py", line 288, in run
    _run_store_command(args)
  File "/home/kit/envs/snapcraft/lib/python3.5/site-packages/snapcraft-2.27-py3.5.egg/snapcraft/main.py", line 349, in _run_store_command
    snapcraft.push(args['<snap-file>'], release_channels)
  File "/home/kit/envs/snapcraft/lib/python3.5/site-packages/snapcraft-2.27-py3.5.egg/snapcraft/_store.py", line 433, in push
    store.push_precheck(snap_name)
  File "/home/kit/envs/snapcraft/lib/python3.5/site-packages/snapcraft-2.27-py3.5.egg/snapcraft/storeapi/__init__.py", line 190, in push_precheck
    self.sca.snap_push_precheck, snap_name)
  File "/home/kit/envs/snapcraft/lib/python3.5/site-packages/snapcraft-2.27-py3.5.egg/snapcraft/storeapi/__init__.py", line 169, in _refresh_if_necessary
    return func(*args, **kwargs)
  File "/home/kit/envs/snapcraft/lib/python3.5/site-packages/snapcraft-2.27-py3.5.egg/snapcraft/storeapi/__init__.py", line 522, in snap_push_precheck
    raise errors.StorePushError(data['name'], response)
snapcraft.storeapi.errors.StorePushError: You are not the publisher or allowed to push revisions for this snap. To become the publisher, run `snapcraft register blr-says2` and try to push again.

[Kit Randel (blr)]

Right, so the point of confusion is that the pre-flight check on the store currently on considers snap name registration, not ownership.

[Leo Arias (elopio)]

so, not a regression, it just never worked, that's better :)

$ snapcraft push elopio-my-snap-name_0.1_amd64.snap --release=edge
Pushing 'elopio-my-snap-name_0.1_amd64.snap' to the store.
You are not the publisher or allowed to push revisions for this snap. To become the publisher, run `snapcraft register elopio-my-snap-name` and try to push again.

Thanks Kit.

[Michael Nelson (michael.nelson)]

So the preflight/dry-run check does ensure that the name of your upload is already registered (the original description was with an older snapcraft before the functionality was added).

The preflight/dry-run has never checked whether you have permission to upload to a given existing snap name (it's not as simple as ownership). The snap push handler doesn't check this without the dry-run option either - up until now it's always been checked long after the handler returns, while processing the upload - that's where the "You do not have access to modify this package." error is being generated.

It's not impossible to move that check into the handler, but it's not as simple as checking if the name is owned by the uploader (they may be a collaborator on a related application etc.)

If I've understood correctly, a more accurate title for this bug would be "pre-flight checks do not check upload permissions for a name", and it should not affect developers uploading their own snaps, but rather only those developers who try to contribute to other snaps for which they don't yet have permission. Is that correct?

[Brian Murray (brian-murray)]

I think there are actually two separate bugs, one regarding name registration (see also my duplicate bug) and another regarding permissions for a name.