snapcraft part sources are not verified for authenticity
Metadata
Current evaluation
Feature request to add GPG signature verification for snapcraft part sources (source-signer-keys). Open ~10 years with 0 comments, no labels, no maintainer interaction; feature never implemented in current codebase.
Suggested action: needs triage
Reason: The issue has no labels, 0 comments, and no maintainer response in ~10 years, so it has never been triaged. However, close_stale is not justified: I confirmed via grep and commit search that source-signer-keys/source_signature do not exist in the current codebase, so the feature was never implemented and the underlying supply-chain gap still applies. A maintainer needs to decide whether to close it as an outdated proposal or keep it as a wishlist item.
Impact:
55
Quick Win:
15.4
Staleness:
92
Complexity:
72
Confidence:
70
Support Request:
5
Issue body
As we well know in the world of Ubuntu/Debian, critical resources are often served over unauthenticated, unencrypted streams, and later verified with cryptographic signatures. That we do this our only justification for continuing to use cleartext protocols like HTTP to serve images and such. We think it's important and obvious.
snapcraft does not check if a downloaded source is verified before using that source and obscuring its contents.
I think almost every source type could be verified.
Example:
plugin: autotools
source: https://www.torproject.org/dist/tor-0.2.8.7.tar.gz
source-signer-keys: [ 0x28988BF5, 0x19F78451, 0x165733EA, 0x8D29319A ]
For a zipfiles or tarballs, the steps are obvious. Also download source + ".asc". Check if it's signed with any of the keys whose IDs are in the signers list and that the signature matches content.
"gpg --verify sourcefile.asc sourcefile"
For bzr and git, verify that the most recent commit is signed with any such key.
For PPAs, verify that they are signed with keys (perhaps already handled by APT).
That leaves hg and svn, which I don't know enough about, and local, which doesn't make sense.
(Incidentally, print warnings to discourage listing 32-bit ids like example uses. They're too weak.)
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen/qwen3.8-27b |
Impact:
55
Quick Win:
15.4
Staleness:
92
Complexity:
72
Confidence:
70
Support Request:
5
|
needs triage | Feature request to add GPG signature verification for snapcraft part sources (source-signer-keys). Open ~10 years with 0 comments, no labels, no maintainer interaction; feature never implemented in current codebase. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
98
Complexity:
70
Confidence:
90
Support Request:
10
|
close stale | Feature request to add GPG signature verification for snapcraft sources. Unaddressed for nearly a decade with no maintainer interaction or activity. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
95
Complexity:
60
Confidence:
70
Support Request:
0
|
needs triage | Feature request to add cryptographic signature verification for snapcraft part sources. Open for ~10 years with zero maintainer interaction, labels, or comments. | |
| qwen3.6-35b-a3b-mtp-q6 |
Staleness:
98
Complexity:
75
Confidence:
80
Support Request:
5
|
close stale | Feature request to add cryptographic verification for snapcraft build sources across multiple formats. Unlabelled, zero comments, and inactive for nearly eight years. | |
| qwen3.6-35b-a3b-mtp-q6 |
Staleness:
98
Complexity:
50
Confidence:
90
Support Request:
10
|
close stale | Snapcraft downloads build sources without verifying cryptographic authenticity. Proposes adding a source-signer-keys field to validate archives, VCS, and PPAs via GPG. Stale, unassigned, and needs triage. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1634038 Snapcraft should verify namespace before uploading | snapcraft (launchpad) | open | Feature request from 2016 asking snapcraft to verify the user's namespace before uploading, to avoid expensive post-upload failures. Open for ~10 years with zero comments, no labels, and no maintainer interaction. | |
| #1583236 snapcraft APT sources checking too strict | snapcraft (launchpad) | open | snapcraft fails builds when APT exits nonzero for non-critical warnings (e.g., outdated hash functions, unsupported PPAs). Unlabelled, zero comments, no maintainer interaction; references obsolete 2015-era sources. | |
| #1640897 snapcraft doesn't validate gadget.yaml | snapcraft (launchpad) | open | Feature request from 2015 asking snapcraft to validate gadget.yaml metadata for gadget snaps instead of just copying it. Open for nearly 10 years with no labels, comments, or maintainer activity. |