snap installer: assert injected snaps
Metadata
Current evaluation
Merged PR #153 as commit b0d058a, adding snap known/ack assertion handling for signed injected snaps while preserving dangerous installation for unsigned snaps.
Resolution: closed resolved
Reason: PR #153 was merged into the mainline as commit b0d058a. It collects signed snap assertions, transfers them to providers, and acknowledges them before installation.
Evaluated by: mr-cal-bot
No scores available.
Issue body
- [X] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)?
-----
### Overview
Assert signed snaps injected into a provider.
### Details
If a snap on the host is signed (not dangerous), then craft-providers will:
1. collect the assertions from the host with `snap known`
2. push the assertions to the instance
3. add the assertions in the instance with `snap ack`
If the snap is unsigned on the host, then the snap is installed dangerously in the instance. This behavior is unchanged.
The implementation in [snapcraft_legacy](https://github.com/snapcore/snapcraft/blob/433a09262443d645acbae5204b5c9a44433f4b83/snapcraft_legacy/internal/build_providers/_snap.py) was used as a reference.
I tested this manually with snapcraft, switching between dangerous and non-dangerous snaps. The integration tests here already test for both scenarios too (I added those tests in the [previous PR](https://github.com/canonical/craft-providers/pull/152)).
(CRAFT-1372)
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Merged PR #153 as commit b0d058a, adding snap known/ack assertion handling for signed injected snaps while preserving dangerous installation for unsigned snaps. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged #153 adds assertion handling for injected signed Snaps: host assertions are collected and acknowledged in the instance; unsigned Snaps remain dangerously installed. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged as b0d058a: injected signed snaps now transfer host assertions via snap known/snap ack; unsigned snaps remain dangerously installed. | |
| qwen/qwen3.6-35b-a3b | — | closed resolved | Merged PR #153 in craft-providers to assert signed snaps injected into providers via snap known/ack, handling dangerous snaps as before. |
Update history
| Date | Change |
|---|---|
| created |
Related work
-
Related To:
canonical/craft-providers#152
(confidence 98%)
The preceding PR added integration coverage for dangerous and non-dangerous snap installation.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #152 snap installer: refactor | craft-providers | merged | Merged PR #152 in commit 0e51d9a, refactoring snap_installer without functional changes and adding integration coverage for dangerously installed snaps. | |
| #159 snap installer: get assertion for the publisher's account id | craft-providers | merged | Merged PR #159 (commit 1fa7819): snap_installer now also collects the publisher's account assertion via `snap known account account-id=<id>` when injecting a snap, fixing rockcraft 309 'cannot resolve prerequisite assertion' errors. |