fix: improve logs when Ubuntu Pro credentials are not available by cristiangirlea · Pull Request #326 · canonical/chisel

cristiangirlea · 2026-09-23T08:04:46Z

Have you signed the CLA?

Fixes #207

When a release defines Ubuntu Pro archives (as ubuntu-24.04 does) and no
credentials are available, chisel cut logged an error-like message for
every Pro archive followed by a per-archive "ignored" line. Users not
using Pro archives at all found this confusing, and nothing tied the
messages to Ubuntu Pro.

Chisel now reports the ignored Pro archives in a single line, stays quiet
about the default credentials directory being absent, and still reports a
credentials directory that was set explicitly but cannot be read. When
valid credentials are present the logs are unchanged.

Changes

cmd/chisel: cut and debug check-release-archives collect the Pro
archives (archiveInfo.Pro set) whose credentials are not found and log
them once, sorted: Ubuntu Pro archives without credentials ignored: .... Any other archive without credentials keeps its own log line. The
archive package is unchanged in this respect and returns
ErrCredentialsNotFound as before.
internal/archive: a missing /etc/apt/auth.conf.d is no longer logged,
since that directory comes with apt. A directory set via
CHISEL_AUTH_DIR that cannot be read, or any other error reading the
default one, is still logged so a mistyped path leaves a lead. The doc
comment of findCredentialsInDir was also corrected: it claimed the
function returns empty credentials with a nil error, but it returns
ErrCredentialsNotFound.
Tests: TestRunIgnoresProArchivesWithoutCredentials covers the single
line for Pro archives and the per-archive line for others through
debug check-release-archives (which has the archiveOpen hook; cut
shares the same logic); TestFindCredentialsDefaultDirMissing,
TestFindCredentials and TestFindCredentialsInDirMissingDir cover
which directory problems are logged.

Verification

go test ./..., go test ./internal/archive/ --real-archive, go fmt and
golangci-lint run (v2.11.3, as in CI) pass, also after merging current
main. The new tests fail without the change they cover.

Before / after with a real release:

chisel cut --release ubuntu-24.04 --root /tmp/rootfs base-files_base

No /etc/apt/auth.conf.d, before:

Cannot open credentials directory "/etc/apt/auth.conf.d": open /etc/apt/auth.conf.d: no such file or directory
Archive "ubuntu-esm-apps" ignored: credentials not found
Cannot open credentials directory "/etc/apt/auth.conf.d": open /etc/apt/auth.conf.d: no such file or directory
Archive "ubuntu-esm-infra" ignored: credentials not found

After (the same with an empty /etc/apt/auth.conf.d):

Ubuntu Pro archives without credentials ignored: ubuntu-esm-apps, ubuntu-esm-infra

With CHISEL_AUTH_DIR=/nonexistent the "Cannot open credentials directory"
line is still printed, since the directory was asked for explicitly.

When a release defines Ubuntu Pro archives and no credentials are available, Chisel logged an error-like message for every Pro archive ("Cannot open credentials directory ...") followed by one "Archive ... ignored: credentials not found" line per archive. Users not using Pro archives at all found this confusing. A missing credentials directory is now handled silently (other errors opening it are still logged), and the archives ignored because of missing credentials are reported in a single informative message: Ubuntu Pro subscription not available, ignoring archives: ubuntu-esm-apps, ubuntu-esm-infra When valid credentials are available the logs are unchanged. Fixes canonical#207 Assisted-by: AI tools

cristiangirlea · 2026-10-11T18:35:08Z

@upils could you take a look at this when you have time? It's a small change to the logging for #207 (Ubuntu Pro credentials). CI is waiting for approval since I'm a first-time contributor here. Happy to adjust anything.

upils

Thanks for your submission @cristiangirlea!

I agree the user experience could be improved. You are on the right track but the approach can be refined to avoid misleading messages.

upils · 2026-10-12T12:38:12Z

 		if err != nil {
 			if err == archive.ErrCredentialsNotFound {
-				logf("Archive %q ignored: credentials not found", archiveName)
+				ignoredArchives = append(ignoredArchives, archiveName)


Getting this error here is not conceptually tied to Pro. Even if today we only look for creds for Pro, in the future it could be for other archives, for example PPA. But this knowledge is confined to the archive package. So presenting these errors as "Ubuntu Pro subscription not available..." is making assumption on the archive package behavior and so can quickly become misleading.

Also a Pro subscription could cover different archives (ESM, FIPS), so Pro could be available but only for a subset of them. The current message would then be misleading (even if ignored archives are listed), staying the subscription is not available when it actually is.

So maybe what we could do instead is:

have archive package clearly communicate some credentials for pro archives were not found (maybe with a new error type or named error returned by candidateArchiveURLs?)

report that, without claiming anything on the actual subscription status. Maybe with something like "Ignored Pro archives: ....".

upils · 2026-10-12T12:41:57Z

+		if !os.IsNotExist(err) {
+			logf("Cannot open credentials directory %q: %v", credsDir, err)
+		}


With this approach, user giving by mistake a non-existent credsDir would end up with a message not providing any lead on how to solve the issue.

Only the archive package knows that credentials were looked up for an Ubuntu Pro archive, so candidateArchiveURLs now returns ErrProCredentialsNotFound in that case. The error wraps ErrCredentialsNotFound, and cut and debug check-release-archives check both with errors.Is: Pro archives are listed in a single line saying what was ignored and why, without claiming anything about the subscription itself, since credentials may exist for other Pro archives. An archive ignored for missing credentials for any other reason keeps its own log line. Also puts the makeChiselYaml doc comment back on that function.

The previous commit skipped the "Cannot open credentials directory" log for any missing directory, so a mistyped CHISEL_AUTH_DIR left no lead at all. Now only the default /etc/apt/auth.conf.d is allowed to be missing silently, since that is the normal state of a system without Ubuntu Pro credentials. A directory set via CHISEL_AUTH_DIR, or any other problem reading the default one, is logged as before.

cristiangirlea · 2026-10-12T17:30:35Z

Thanks, both points taken.

The archive package now returns ErrProCredentialsNotFound (wrapping ErrCredentialsNotFound) from candidateArchiveURLs, and the commands only list what was ignored: Ignored Ubuntu Pro archives without credentials: ..., nothing about the subscription.

For the directory: only the default /etc/apt/auth.conf.d may be missing silently; a CHISEL_AUTH_DIR that can't be read is logged as before. Happy to log in both cases instead if you'd prefer.

The description is updated to match.

upils

Thanks @cristiangirlea. I have a few more comments, but this is getting close :).

upils · 2026-10-15T09:47:22Z

+			continue
+		} else if errors.Is(err, archive.ErrCredentialsNotFound) {


Suggested change

continue

} else if errors.Is(err, archive.ErrCredentialsNotFound) {

continue

}

if errors.Is(err, archive.ErrCredentialsNotFound) {

} else if after a continue is unnecessary. (following another comment this one may become irrelevant)

Done, it's two separate ifs now, as in your suggestion.

upils · 2026-10-15T09:49:50Z

+// logIgnoredProArchives logs a single message listing the Ubuntu Pro archives
+// that were ignored because no credentials were found for them. It says
+// nothing about the subscription itself: credentials may well exist for
+// other Pro archives.


4 lines of comments stating what a 6 lines function does is not great. I think what the function does is easily enough to grasp to not need a comment.

upils · 2026-10-15T11:21:55Z

+// ErrProCredentialsNotFound is returned when an Ubuntu Pro archive is requested
+// but no credentials for it are found. It matches ErrCredentialsNotFound in
+// errors.Is comparisons.


This also feels superfluous, documenting a behavior living in another place and an obvious behavior (error wrapping and error.Is).

Gone together with the error.

upils · 2026-10-15T11:29:06Z

+		return
+	}
+	sort.Strings(archiveNames)
+	logf("Ignored Ubuntu Pro archives without credentials: %s", strings.Join(archiveNames, ", "))


Sorry my suggestion was slightly inconsistent with the other error message for non-Pro archives. What about "Ubuntu Pro archives without credentials ignored: %s"?

Changed to "Ubuntu Pro archives without credentials ignored: %s".

upils · 2026-10-15T11:39:32Z

+// ErrProCredentialsNotFound is returned when an Ubuntu Pro archive is requested
+// but no credentials for it are found. It matches ErrCredentialsNotFound in
+// errors.Is comparisons.
+var ErrProCredentialsNotFound = fmt.Errorf("%w for Ubuntu Pro archive", ErrCredentialsNotFound)


Now I think this it not the best approach because this credentials file has to gain knowledge of the "Pro" concept and I think we can avoid that.

We can keep returning the same error as before (so credential.go would be untouched) and in cmd_cut.go we know the archive we try to open is pro so there we can branch and collect the errors.

Agreed, that's cleaner. ErrProCredentialsNotFound is gone and archive.go is back to what it was, so the archive package returns ErrCredentialsNotFound as before. Both commands now check archiveInfo.Pro to collect the Pro archives. The only change left in internal/archive is the default directory handling from the last round.

upils · 2026-10-15T11:52:28Z

+	// A directory given explicitly is reported when it cannot be read, so a
+	// mistyped CHISEL_AUTH_DIR leaves a lead in the logs.


Same here on the level of docs.

upils · 2026-10-15T11:58:54Z

+	restoreDir := archive.FakeDefaultCredsDir(credsDir)
+	defer restoreDir()
+
+	// Without Ubuntu Pro credentials the default directory usually does not


This is not true, this default folder comes from the apt package, this is unrelated to Ubuntu Pro. So without apt is it likely to not exist and without Ubuntu Pro it may be empty but there might be content in it for any other archives configured on the machine. It just happens that for now it only surfaces when trying to open a Pro archive but from the perspective of the findCredentials function this is not tied to Pro.

You're right, thanks. Corrected: the comment now says the directory comes with apt.

The commands already know which archives are Ubuntu Pro ones, so they can group the Pro archives whose credentials are not found without a Pro-specific credentials error. Drop ErrProCredentialsNotFound and its test, branch on the archive's Pro setting instead, and word the message like the one for other archives. Also correct a test comment that tied a missing /etc/apt/auth.conf.d to Ubuntu Pro: the directory comes with apt.

upils suggested changes Oct 12, 2026

View reviewed changes

cristiangirlea added 2 commits October 12, 2026 20:03

upils suggested changes Oct 15, 2026

View reviewed changes

		continue
		} else if errors.Is(err, archive.ErrCredentialsNotFound) {

		// A directory given explicitly is reported when it cannot be read, so a
		// mistyped CHISEL_AUTH_DIR leaves a lead in the logs.

Conversation

cristiangirlea commented Sep 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Verification

Uh oh!

cristiangirlea commented Oct 11, 2026

Uh oh!

upils left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cristiangirlea commented Oct 12, 2026

Uh oh!

upils left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

cristiangirlea commented Sep 23, 2026 •

edited

Loading