feat(i/snap): add snap-declaration assertion filters
Metadata
Current evaluation
Merged in canonical/fetch-service#250 (commit 49d6a0d), adding snap-declaration header filters, including publisher-id allowlists, and fixing #249.
Resolution: closed resolved
Reason: The approved PR was merged as commit 49d6a0d, implementing inspectors.yaml snap-declaration filters and explicitly fixing #249.
Evaluated by: mr-cal-bot
No scores available.
Issue body
Snap-declaration assertion filters allow downloaded snaps to be
filtered according to snap-declaration assertion headers. To filter
based on publisher-id, add:
```
snap:
snap-declaration:
- name: publisher-id
value: [... allowed IDs ...]
```
to the inspectors.yaml configuration file.
Fixes: #249
- [x] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)?
-----
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Merged in canonical/fetch-service#250 (commit 49d6a0d), adding snap-declaration header filters, including publisher-id allowlists, and fixing #249. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged in canonical/fetch-service#250 (49d6a0d), adding inspectors.yaml snap-declaration filters, including publisher-id, and resolving #249. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged as #250 in commit 49d6a0d, adding snap-declaration filters, including publisher-id, and fixing #249. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged as PR #250 (commit 49d6a0d), adding inspectors.yaml snap-declaration assertion filters (e.g. publisher-id) to the snap inspector; landed via #252 into main and closed issue #249. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged as #250 (49d6a0d), adding inspectors.yaml snap-declaration filters for publisher-id to restrict snap downloads and close #249. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged following two approvals and CI validation. Implements snap-declaration assertion filters in inspectors.yaml to restrict downloads by publisher-id, resolving issue #249. Rebased on feature/configurability. |
Update history
| Date | Change |
|---|---|
| created |
Related work
-
Related To:
canonical/fetch-service#249
(confidence 100%)
PR #250 explicitly fixes this issue with publisher-based snap-declaration filtering.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #249 Only allow snaps published by Canonical in strict mode | fetch-service | closed | Fixed by merged PR canonical/fetch-service#250 (49d6a0d), adding snap-declaration publisher filters so strict mode accepts only Canonical-published snaps. | |
| #414 fix(i/snap): fix snap declaration assertion parsing | fetch-service | merged | Merged in #414 as commit a47e7d2, fixing snap declaration assertion parsing without requiring authority-id to be the second field; fixes #413. |