pkgdev bugs repeatedly throws 400

[ferringb]

The invocation is below; this is being ran against a github mirror clone of gentoo-x86. Admittedly with my snakeoil and pkgcore modifications, but nothign in them is involved here (I checked).

(pkgcore) ferringb@hrair /var/db/repos/gentoo $ pkgdev bugs sys-apps/portage
gentoo -- updating profiles cache: x86        
gentoo -- updating git cache: commit date: 2025-11-21
Checking =sys-apps/portage-3.0.72 on 'amd64 arm arm64 ppc ppc64 x86'
Check for open bugs matching current graph? [Yes/No] (default: No): y
Traceback (most recent call last):
  File "/home/ferringb/gentoo/venv/bin/pkgdev", line 10, in <module>
    sys.exit(main())
             ~~~~^^
  File "/home/ferringb/gentoo/pkgdev/src/pkgdev/scripts/__init__.py", line 48, in main
    run(os.path.basename(sys.argv[0]))
    ~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/ferringb/gentoo/pkgdev/src/pkgdev/scripts/__init__.py", line 40, in run
    sys.exit(tool())
             ~~~~^^
  File "/home/ferringb/gentoo/snakeoil/src/snakeoil/cli/tool.py", line 83, in __call__
    ret = self.main()
  File "/home/ferringb/gentoo/pkgdev/src/pkgdev/cli.py", line 23, in main
    return super().main()
           ~~~~~~~~~~~~^^
  File "/home/ferringb/gentoo/snakeoil/src/snakeoil/cli/tool.py", line 190, in main
    self.handle_exec_exception(e)
    ~~~~~~~~~~~~~~~~~~~~~~~~~~^^^
  File "/home/ferringb/gentoo/snakeoil/src/snakeoil/cli/tool.py", line 175, in main
    exitstatus = func(self.options, self.out, self.err)
  File "/home/ferringb/gentoo/pkgdev/src/pkgdev/scripts/pkgdev_bugs.py", line 770, in main
    d.scan_existing_bugs(options.api_key)
    ~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^
  File "/home/ferringb/gentoo/pkgdev/src/pkgdev/scripts/pkgdev_bugs.py", line 704, in scan_existing_bugs
    with urllib.urlopen(request, timeout=30) as response:
         ~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.13/urllib/request.py", line 189, in urlopen
    return opener.open(url, data, timeout)
           ~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.13/urllib/request.py", line 495, in open
    response = meth(req, response)
  File "/usr/lib/python3.13/urllib/request.py", line 604, in http_response
    response = self.parent.error(
        'http', request, response, code, msg, hdrs)
  File "/usr/lib/python3.13/urllib/request.py", line 533, in error
    return self._call_chain(*args)
           ~~~~~~~~~~~~~~~~^^^^^^^
  File "/usr/lib/python3.13/urllib/request.py", line 466, in _call_chain
    result = func(*args)
  File "/usr/lib/python3.13/urllib/request.py", line 613, in http_error_default
    raise HTTPError(req.full_url, code, msg, hdrs, fp)
urllib.error.HTTPError: HTTP Error 400: Bad Request

For whoever has some awareness on this command, it'd be good to comment on what the endpoint is and potential notions, and if this subcmd should still exist. If it shouldn't, I'll wipe it.

[thesamesam]

I think it does this without an API key. The subcmd is actively used though.

[ferringb]

If an API key is required, that endpoint should be 401 (auth denied), not 400 (bad request).

My rough notions here:

• If it's 401, the error we show should link how to get credentials, while telling them they're not authorized.
• The service should be fixed if this is a 400 for auth issues, rather than just a bad request.
  " Actual 400- we submitted a bad request- our thrown exception needs to carry enough info to debug it. What I saw doesn't feel like that.

Am I missing anything in this scenario? I don't know the service in question, nor where its code lives, but if you do please comment.

[thesamesam]

It's all Bugzilla's API. #209 is another example of this btw w/ no API key.

For other causes (usually too large package lists):

• pkgdev bugs: urllib.error.HTTPError: HTTP Error 400: Bad Request on Ruby packages #141
• pkgdev bugs: filing a stablereq with a large package list fails (urllib.error.HTTPError: HTTP Error 400: Bad Request) #213

[arthurzam]

Yes, API key has become required in one of the last bugs.g.o changes, so I should indeed update it to be required

[thesamesam]

Reopening as we reverted the fix for now