snapcraft produces snaps with dangling external symlinks
Metadata
Current evaluation
Closed without resolution. Snapcraft generated snaps with dangling external symlinks for system libraries and Java components. A manual unpack, remove, and repack workaround was provided, but no upstream fix was implemented.
Suggested action: —
No scores available.
Issue body
I used snapcraft to package minecraft (to test security policy on a non-trivial java program). Here is the bzr tree: lp:~jdstrand/+junk/minecraft-snap
$ click-review minecraft_0.1_amd64.snap
Errors
------
- lint_external_symlinks
package contains external symlinks: /tmp/clickreview-fo5rcfjk/usr/lib/x86_64-linux-gnu/libnss_nis.so, /tmp/clickreview-fo5rcfjk/usr/lib/x86_64-linux-gnu/libnss_hesiod.so, /tmp/clickreview-fo5rcfjk/usr/lib/x86_64-linux-gnu/libresolv.so, /tmp/clickreview-fo5rcfjk/usr/lib/x86_64-linux-gnu/libutil.so, /tmp/clickreview-fo5rcfjk/usr/lib/x86_64-linux-gnu/libcidn.so, /tmp/clickreview-fo5rcfjk/usr/lib/x86_64-linux-gnu/libnsl.so, /tmp/clickreview-fo5rcfjk/usr/lib/x86_64-linux-gnu/libnss_files.so, /tmp/clickreview-fo5rcfjk/usr/lib/x86_64-linux-gnu/libBrokenLocale.so, /tmp/clickreview-fo5rcfjk/usr/lib/x86_64-linux-gnu/libnss_dns.so, /tmp/clickreview-fo5rcfjk/usr/lib/x86_64-linux-gnu/libnss_compat.so, /tmp/clickreview-fo5rcfjk/usr/lib/x86_64-linux-gnu/librt.so, /tmp/clickreview-fo5rcfjk/usr/lib/x86_64-linux-gnu/libm.so, /tmp/clickreview-fo5rcfjk/usr/lib/x86_64-linux-gnu/libthread_db.so, /tmp/clickreview-fo5rcfjk/usr/lib/x86_64-linux-gnu/libcrypt.so, /tmp/clickreview-fo5rcfjk/usr/lib/x86_64-linux-gnu/libdl.so, /tmp/clickreview-fo5rcfjk/usr/lib/x86_64-linux-gnu/libnss_nisplus.so, /tmp/clickreview-fo5rcfjk/usr/lib/x86_64-linux-gnu/libanl.so, /tmp/clickreview-fo5rcfjk/usr/lib/jvm/java-7-openjdk-amd64/jre/lib/security/cacerts
This check in the review tools is looking at the symlink in the unpacked snap and seeing if they point outside of the snap's directories. The goal of the check is to point out problems when installing a snap on a minimal system like Ubuntu Core where the target files may not exist. For example, after installing the snap, /apps/minecraft.sideload/current/usr/lib/jvm/java-7-openjdk-amd64/jre/lib/security/cacerts is a dangling symlink to the non-existent /etc/ssl/certs/java/cacerts.
This is not a security issue because AppArmor will resolve the symlinks before applying policy.
This is known to at least affect 'stage-packages: openjdk-7-jre-headless' and 'type: python3-project'
WORKAROUND: if you have a snap that does this, use snapcraft, run the review tools on it to see the list external symlinks, then unpack the snap, remove the external symlinks, then repack the snap.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen/qwen3.6-35b-a3b | — | — | Closed without resolution. Snapcraft generated snaps with dangling external symlinks for system libraries and Java components. A manual unpack, remove, and repack workaround was provided, but no upstream fix was implemented. | |
| qwen/qwen3.6-35b-a3b | — | — | Closed without resolution. The report flagged linting warnings for dangling external symlinks in snaps using OpenJDK or Python projects. The author noted it is not a security issue and provided a manual workaround. The report was abandoned. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Closed without resolution, likely abandoned or superseded. The author provided a manual unpack, symlink removal, and repack workaround for snaps containing dangling external symlinks. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1650686 Some symlinks not properly fixed up | snapcraft (launchpad) | closed | Abandoned. Closed without comments or resolution. The snapcraft build failure caused by unpatched absolute symlinks remains unresolved, with no fix implemented. | |
| #1889674 built python snap fails automated review due to external symlinks | snapcraft (launchpad) | closed | Closed without comments. Snapcraft 4.1.1 created external symlinks that triggered automated store review failures. The report was likely abandoned or superseded by upstream Snapcraft fixes that corrected symlink handling in subsequent versions. | |
| #1742373 Zip packages are not extracted properly with snapcraft 2.35 | snapcraft (launchpad) | closed | Closed without documented resolution. Author provided a code workaround. Likely abandoned or resolved in a later release. | |
| #1761598 Snapcraft modifies binaries | snapcraft (launchpad) | closed | Closed without resolution. Snapcraft 2.39.2 and 2.40.1 modified binaries by adding 4096 bytes, a regression from 2.35. The report was abandoned with no comments or fix applied. |