← Back to issue list

No explanation for using local GPG keys

View original Github issue

Metadata

Project
craft-archives
Number
#190
Type
issue
State
open
Author
dilyn-corner
Labels
Status: Triaged Type: Documentation Type: Enhancement
Created
Updated
Closed
—

Current evaluation

Documentation gap: repo_properties.rst lacks explanation of local GPG key usage (snap/keys/<last8>.asc) for APT repos. Triaged, maintainer acknowledged, synced to Jira CRAFT-4692. Docstrings in package_repository.py now partially cover it, but RST docs still missing the explanation. Inactive ~12.7 months.

Suggested action: keep open

Reason: The issue is properly triaged (Status: Triaged label), acknowledged by maintainer @lengau who scoped it into two parts, and synced to Jira CRAFT-4692. The documentation gap in docs/reference/repo_properties.rst still exists — it documents key-id and key-server but not the local key asset mechanism. While PR #162 added docstrings to package_repository.py explaining the snap/keys/<short-thumbprint>.asc lookup, the standalone RST reference page the issue specifically calls out remains unchanged. Inactivity exceeds a year but the issue is not irrelevant.

Impact: 35 Quick Win: 28.0 Staleness: 62 Complexity: 20 Confidence: 72 Support Request: 10

Issue body

https://github.com/canonical/craft-archives/blob/7c35cc475af18f1525e75b206e828a3b1bf23a38/docs/reference/repo_properties.rst?plain=1#L2 The documentation does not explain how to use a local GPG key instead of relying on a key server. For instance I would expect this explanation to be somewhere: https://github.com/canonical/craft-archives/blob/7c35cc475af18f1525e75b206e828a3b1bf23a38/craft_archives/repo/apt_key_manager.py#L81-L98 Along with the path the key must be in (`snap/keys/lasteightcharacters.asc`), and that local keys would be privileged over remote keys: https://github.com/canonical/craft-archives/blob/7c35cc475af18f1525e75b206e828a3b1bf23a38/craft_archives/repo/apt_key_manager.py#L249-L253 In general, an explanation on how to get the ASC, identify the fingerprint, and the ID would be exceptionally useful (as most people are still quite unaware of how GPG works or what these things mean...)

Evaluation history

Date Model Scores Action Summary
qwen/qwen3.8-27b
Impact: 35
Quick Win: 28.0
Staleness: 62
Complexity: 20
Confidence: 72
Support Request: 10
keep open Documentation gap: repo_properties.rst lacks explanation of local GPG key usage (snap/keys/<last8>.asc) for APT repos. Triaged, maintainer acknowledged, synced to Jira CRAFT-4692. Docstrings in package_repository.py now partially cover it, but RST docs still missing the explanation. Inactive ~12.7 months.
qwen/qwen3.6-35b-a3b
Staleness: 85
Complexity: 20
Confidence: 85
Support Request: 10
keep open Documentation enhancement requesting guidance on using local GPG keys, including paths, privileges, and key identification. Currently triaged but inactive for over a year with a Jira ticket created.
qwen3.6-35b-a3b-mtp-q6
Staleness: 85
Complexity: 25
Confidence: 75
Support Request: 10
keep open Documentation enhancement requesting guidance on using local GPG keys instead of key servers, including key paths, privileges, and GPG basics. Currently triaged and linked to an internal Jira ticket, but inactive for ~11 months.
qwen3.6-35b-a3b-mtp-q6
Staleness: 75
Complexity: 25
Confidence: 85
Support Request: 10
keep open Missing docs for local GPG key usage, including paths, remote precedence, and basic GPG concepts. Triaged and split into app-author and user-facing tracks. Internal ticket CRAFT-4692 created. Pending documentation updates.

Update history

No update history recorded yet.

Related work

  • Related To: craft-archives#162 (confidence 65%)

    Commit 4c16960 'chore: add fields and docstrings to package repository models' added docstrings to key_id fields explaining the local key lookup in snap/keys/, partially addressing the documentation gap but not updating the RST reference page.

Related issues

Issue Project State Summary Similarity
#5697 Explain how to use local GPG keys for a repository snapcraft open Docs enhancement: package-repositories reference page links to craft-archives but doesn't explain local GPG keyring format or storage location. Triaged, no activity in ~12.7 months, gap still present in docs.
81%