snapcraft should check file creation permissions and warn/error out instead of generating a non-functional snap
Metadata
Current evaluation
⚠️ This summary may be outdated — the issue content or evaluation prompts have changed since this evaluation was made.
Closed without resolution. The requested permission checks were not implemented, and the issue remains abandoned.
Suggested action: —
No scores available.
Issue body
This probably qualifies as a corner case, but I came across this and I thought snapcraft could do a better job of preventing uninstallable snaps. I was handed over a snap (created with snapcraft) for testing, and it wouldn't install:
$ sudo snap install --dangerous foobar.snap
error: cannot install snap file: snap is unusable due to bad permissions; contact developer
$ journalctl -u snapd
Apr 03 14:09:28 snapd[162506]: container.go:204: in snap "foobar": "meta" should be world-readable and executable, and isn't: drwxr-x---
Apr 03 14:09:28 snapd[162506]: container.go:204: in snap "foobar": "meta/gui" should be world-readable and executable, and isn't: drwxr-x---
Apr 03 14:09:28 snapd[162506]: container.go:228: in snap "foobar": "meta/gui/foobar.desktop" should be world-readable, and isn't: -rw-r-----
Apr 03 14:09:28 snapd[162506]: container.go:228: in snap "foobar": "meta/snap.yaml" should be world-readable, and isn't: -rw-r-----
My guess is that the default file creation mask on the machine where the snap was built was 640 (and 750 for directories). The snap was successfully built, but it cannot be installed.
My suggestion is to have snapcraft either issue an explicit warning, or better yet error out when this happens, to prevent building a snap that cannot be installed.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen/qwen3.6-35b-a3b | — | — | Closed without resolution. The requested permission checks were not implemented, and the issue remains abandoned. | |
| qwen/qwen3.6-35b-a3b | — | — | Closed without a fix or implementation. The issue appears abandoned or deferred due to zero comments and prolonged inactivity, leaving the requested permission validation unaddressed. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Closed without resolution due to inactivity. Restrictive build-time umasks produce invalid snaps, prompting a recommendation for snapcraft to validate permissions and fail early. No fix was implemented. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1627843 snapcraft should check permissions before starting an upload | snapcraft (launchpad) | closed | Closed without resolution due to prolonged inactivity. The request to validate authentication permissions before uploading large snaps was abandoned, with no fix or implementation added to subsequent versions. | |
| #1800119 snapcraft cleanbuild | snapcraft (launchpad) | closed | Closed without resolution. The report details a PermissionError during snapcraft cleanbuild caused by restricted access to the .aptitude directory. With zero comments and no fix applied, the issue was abandoned or marked stale. | |
| #1530995 Snapcraft requires autogen.sh to be executable | snapcraft (launchpad) | closed | Closed without resolution or comments. Snapcraft requires autogen.sh to have executable permissions, but no action was taken to enforce or document this requirement. | |
| #1990551 snapcraft 7 never drops permissions while doing builds invoked with sudo | snapcraft (launchpad) | closed | Closed without resolution due to inactivity. The report identifies a snapcraft 7 regression where sudo builds retain root privileges instead of dropping them, unlike snapcraft 6. No fix or discussion occurred. | |
| #1723965 snapcraft doesn't work | snapcraft (launchpad) | closed | Closed without resolution or comments, indicating abandonment. The reported snap command failure and GL driver errors remain unresolved. | |
| #1741753 Snapcraft clean fails on root-owned files | snapcraft (launchpad) | closed | Closed without resolution. snapcraft clean failed with a PermissionError when removing root-owned files from the build directory. No fix or discussion was provided. | |
| #1600078 snapcraft upload store integration tests is failing because it needs a manual review | snapcraft (launchpad) | closed | Closed without resolution. The integration test failed when uploaded snaps triggered a mandatory manual review. No pre-approved snap was provided to bypass the check, leaving the issue abandoned. | |
| #6118 snapcraft changes permissions of some files | snapcraft | closed | Rejected as not a snapcraft bug. Unexpected file permission changes were traced to coreutils or the core-base build process. The author closed the issue and referenced core-base PR 421 for the fix. | |
| #1515394 Restrictive umask and permissions may cause a built snap to be unusable | snapcraft (launchpad) | closed | Closed without resolution. The report regarding restrictive umask causing unusable snaps was abandoned due to inactivity. No permission validation or umask enforcement was implemented in snapcraft. | |
| #1699 snapcraft <help> command | snapcraft | closed | Closed without implementation or discussion. No resolution or merge details were provided, indicating the snapcraft help command feature request was abandoned. |