No support for unsigned package-repositories

Metadata

Project: snapcraft (launchpad)
Number: #1918969
Type: issue
State: open
Author: ~racb
Labels: —
Created: 2021-03-12 07:02 PM UTC
Updated: 2021-03-25 04:59 PM UTC
Closed: —

Current evaluation

Feature request: snapcraft package-repositories requires a key-id/key even for local file:/// apt repos; reporter wants a trusted=yes passthrough or to drop the mandatory key. Open since ~2021, zero comments, no labels, no maintainer response.

Suggested action: needs triage

Reason: The issue is ~5.5 years old with zero comments, no labels, and no maintainer interaction, but it is a legitimate feature request (expose apt's trusted=yes or make key-id optional for file:/// repos) rather than stale-and-irrelevant, so it should be triaged by a maintainer to decide whether to implement, close as won't-fix, or confirm the reporter's guess that file:/// repos are already trusted by default. Repo inspection tools were unavailable (no pinned SHA), so I could not verify whether the key requirement still exists in current code.

Impact: 35 Quick Win: 21.0 Staleness: 92 Complexity: 40 Confidence: 55 Support Request: 30

Issue body

My use case is the same as in bug 1918968. I have a local apt repository (file:/// URL) that I'd like to make available via package-repositories. snapcraft currently demands a key-id and a corresponding key (whether available locally in snap/keys/ or from a keyserver). So to use package-repositories in "local mode", I am forced to sign it with a temporary key and provide that to snapcraft. This seems unnecessary because apt supports a [trusted=yes] option in the sources.list entry. Expected: snapcraft exposes an option to set [trusted=yes] to pass through to apt. In the back of my mind I think [trusted=yes] might have recently become the default for file:/// anyway, so it might be sufficient to just stop assuming that a public key always has to be provided. I'm not sure though; if this isn't the case, then I'd like a "trusted: yes" type option under the package-repositories key please.

Evaluation history

Date	Model	Scores	Action	Summary
2026-09-01 07:15 AM UTC	qwen/qwen3.8-27b	Impact: 35 Quick Win: 21.0 Staleness: 92 Complexity: 40 Confidence: 55 Support Request: 30	needs triage	Feature request: snapcraft package-repositories requires a key-id/key even for local file:/// apt repos; reporter wants a trusted=yes passthrough or to drop the mandatory key. Open since ~2021, zero comments, no labels, no maintainer response.
2026-07-23 11:46 AM UTC	qwen/qwen3.6-35b-a3b	Staleness: 98 Complexity: 15 Confidence: 85 Support Request: 10	close stale	Request to support unsigned local apt repositories via a trusted option in snapcraft's package-repositories. The issue has been inactive for over five years with no maintainer response.
2026-07-22 12:18 PM UTC	qwen/qwen3.6-35b-a3b	Staleness: 95 Complexity: 35 Confidence: 90 Support Request: 10	needs triage	Feature request to add a trusted=yes option for unsigned local apt repositories in snapcraft's package-repositories. Unlabelled and untouched for over five years.
2026-07-09 05:30 PM UTC	qwen3.6-35b-a3b-mtp-q6	Staleness: 98 Complexity: 20 Confidence: 85 Support Request: 10	close stale	Feature request to support unsigned local apt repositories via package-repositories by exposing a trusted=yes option or removing mandatory key requirements. Untriaged and inactive for over five years.
2026-06-20 11:55 AM UTC	qwen3.6-35b-a3b-mtp-q6	Staleness: 95 Complexity: 25 Confidence: 85 Support Request: 10	needs triage	Snapcraft requires a GPG key for all package-repositories, blocking local file:// repos. Requests an option to use apt's trusted=yes flag or skip key requirements for unsigned local repositories. Open, unassigned, and awaiting triage.

Update history

No update history recorded yet.

Related issues

No related issues found above the similarity threshold.