snapcraft validate and sign-build are inconsistent when there are multiple keys
Metadata
Current evaluation
snapcraft validate uses the default signing key while sign-build shows a key-selection wizard when multiple keys exist; the two commands should behave consistently. Open since 2016, zero comments, no maintainer response.
Suggested action: needs triage
Reason: The issue is ~9.8 years old with 0 comments, no assignee, and no maintainer response beyond the original report, so it has never been assessed or prioritised. A maintainer should first verify whether the key-selection inconsistency still exists in the current store commands (validate/sign-build) before deciding to fix or close; I could not confirm current behaviour because repo inspection was unavailable (no pinned SHA).
Impact:
20
Quick Win:
14.0
Staleness:
95
Complexity:
30
Confidence:
55
Support Request:
10
Issue body
When there are multiple signing keys, snapcraft sign-build shows a wizard-like text and lets you enter a number to select the key you want. snapcraft validate instead uses the default key.
I'm not sure what's the right behaviour, but they should be consistent.
$ snapcraft list-keys
Name SHA3-384 fingerprint
* default pvqbQVTvSgeMIuUXyr0d_4O_DLQNUDitvmficJ66KYcn_qZKDZcBT6XbgRm7Dcwb
* test 5bsceVZqUkv01S4PxD10guWHQqvCNS7Mwv-I_U089NbcLhC-hnQ78zMGQGr9IZFN
$ snapcraft validate u1test20161026 ubuntu-core=4
Getting details for ubuntu-core
Signing validation ubuntu-core=4
You need a passphrase to unlock the secret key for
user: "default"
4096-bit RSA key, ID D017FEB3, created 2016-01-01
$ snapcraft sign-build *.snap
Select a key:
Number Name SHA3-384 fingerprint
1 default pvqbQVTvSgeMIuUXyr0d_4O_DLQNUDitvmficJ66KYcn_qZKDZcBT6XbgRm7Dcwb
2 test 5bsceVZqUkv01S4PxD10guWHQqvCNS7Mwv-I_U089NbcLhC-hnQ78zMGQGr9IZFN
Key number: 1
You need a passphrase to unlock the secret key for
user: "default"
4096-bit RSA key, ID D017FEB3, created 2016-01-01
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen/qwen3.8-27b |
Impact:
20
Quick Win:
14.0
Staleness:
95
Complexity:
30
Confidence:
55
Support Request:
10
|
needs triage | snapcraft validate uses the default signing key while sign-build shows a key-selection wizard when multiple keys exist; the two commands should behave consistently. Open since 2016, zero comments, no maintainer response. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
100
Complexity:
15
Confidence:
90
Support Request:
0
|
close stale | Inconsistency between snapcraft validate and sign-build regarding key selection when multiple keys exist. Issue is completely inactive for ~9.7 years with no maintainer response. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
98
Complexity:
15
Confidence:
90
Support Request:
10
|
close stale | Inconsistency between snapcraft validate and sign-build when multiple signing keys exist. The issue is extremely stale with no maintainer interaction or activity in nearly a decade. | |
| qwen3.6-35b-a3b-mtp-q6 |
Staleness:
99
Complexity:
20
Confidence:
85
Support Request:
5
|
close stale | Inconsistency between snapcraft validate and sign-build regarding key selection when multiple keys exist. Issue is over 9 years old with no maintainer interaction. | |
| qwen3.6-35b-a3b-mtp-q6 |
Staleness:
98
Complexity:
20
Confidence:
90
Support Request:
10
|
close stale | Inconsistency between snapcraft validate and sign-build key selection with multiple keys. validate auto-selects default while sign-build prompts manually. Awaits triage and consensus on expected behavior. Currently inactive with zero comments. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1486659 snapcraft run uses one ssh key to create the image and another to log in | snapcraft (launchpad) | closed | Inconsistent SSH key selection between snapcraft run and ubuntu-device-flash was closed without resolution. Zero comments indicate the report was abandoned or superseded without a fix. | |
| #1629984 trying to sign-build without keys leaves a -build file, empty | snapcraft (launchpad) | closed | Closed and resolved. The snapcraft sign-build command was patched to prevent creating empty -build files on failure, resolving subsequent assertion conflicts. No further discussion was recorded. |