codeql pack publish fails with confusing SocketException when token lacks permission

[ebickle]

When publishing a codeql pack using codeql pack publish and the GitHub token lacks the write:packages scope, the following error will be shown:

Aug 30, 2023 8:15:17 AM org.apache.http.impl.execchain.RetryExec execute
INFO: I/O exception (java.net.SocketException) caught when processing request to {s}->https://ghcr.io:443: An established connection was aborted by the software in your host machine        
Aug 30, 2023 8:15:17 AM org.apache.http.impl.execchain.RetryExec execute
INFO: Retrying request to {s}->https://ghcr.io:443
Aug 30, 2023 8:15:17 AM org.apache.http.impl.execchain.RetryExec execute
INFO: I/O exception (java.net.SocketException) caught when processing request to {s}->https://ghcr.io:443: An established connection was aborted by the software in your host machine        
Aug 30, 2023 8:15:17 AM org.apache.http.impl.execchain.RetryExec execute
INFO: Retrying request to {s}->https://ghcr.io:443
Aug 30, 2023 8:15:18 AM org.apache.http.impl.execchain.RetryExec execute
INFO: I/O exception (java.net.SocketException) caught when processing request to {s}->https://ghcr.io:443: An established connection was aborted by the software in your host machine        
Aug 30, 2023 8:15:18 AM org.apache.http.impl.execchain.RetryExec execute
INFO: Retrying request to {s}->https://ghcr.io:443
A fatal error occurred: Could not upload blob asurion/asurion-java-queries@0.1.0.

The error An established connection was aborted by software in your host machine makes it seem as though a firewall or antivirus tool blocked the publish. Instead, the shown error message should mention that access was denied.

[MathiasVP]

Hi @ebickle,

Thanks for the suggestion. I've forwarded this to the appropriate CodeQL team, and I'm sure they'll respond to this issue soon!

[aeisenberg]

Thanks for raising this. I've added it to our backlog and we will take a look at it soon. Your request sounds reasonable. Whether or not it is feasible depends on the actual error response we get back from the package registry.

[Akshay865]

@aeisenberg Have you found any fix for this issue yet?

[aeisenberg]

The fix is to ensure that your token uses the appropriate write:packages permissions. This issue is about having a better error message when the token does not have appropriate permissions. If you tried that and are still having a problem, please open a new issue.

[Akshay865]

@aeisenberg I got the same issue for cpp-all package when I hit the command -

codel pack install

Is this a firewall issue or something else?

[aeisenberg]

Can you please open a new issue and someone can help you.

Include the relevant sections of the log. Also, are you using a self hosted runner? If the repository is public, please share the link.