Only allow snaps published by Canonical in strict mode
Metadata
Current evaluation
Fixed by merged PR canonical/fetch-service#250 (49d6a0d), adding snap-declaration publisher filters so strict mode accepts only Canonical-published snaps.
Resolution: closed resolved
Reason: Maintainer @cmatsuoka recorded “Fixed in #250.” PR #250 merged as commit 49d6a0d and added publisher-ID filters for strict-mode snap validation.
Evaluated by: mr-cal-bot
No scores available.
Issue body
### What needs to get done
In strict mode, the snap inspector should only allow published by Canonical.
### Why it needs to get done
To improve validation of snaps
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Fixed by merged PR canonical/fetch-service#250 (49d6a0d), adding snap-declaration publisher filters so strict mode accepts only Canonical-published snaps. | |
| stealth/space-bunny-alpha | — | closed resolved | Strict mode was updated to restrict snap inspection to Canonical-published snaps using snap-declaration publisher filters. PR #250 was merged. | |
| qwen/qwen3.6-35b-a3b | — | — | Implemented strict mode validation to restrict the snap inspector to Canonical-published snaps. The fix was merged in pull request #250, closing the request. |
Update history
| Date | Change |
|---|---|
| created |
Related work
-
Likely Fixed By:
canonical/fetch-service#250
(confidence 100%)
Merged as commit 49d6a0d; added snap-declaration assertion filters to enforce the requested publisher restriction.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #250 feat(i/snap): add snap-declaration assertion filters | fetch-service | merged | Merged in canonical/fetch-service#250 (commit 49d6a0d), adding snap-declaration header filters, including publisher-id allowlists, and fixing #249. |