The 'url' of 'package-repositories' can't handle PPA token from the environment variable
Metadata
Current evaluation
Feature request: snapcraft should expand environment variables in package-repositories URL fields to avoid embedding sensitive PPA tokens in snapcraft.yaml
Suggested action: needs triage
Reason: The issue has no labels, no maintainer response, no assignee, and 0 comments after 1295 days. While the security concern about embedding PPA tokens in YAML files is valid, the issue has not been triaged or acknowledged by maintainers. The age of the issue (3.5 years) and the lack of engagement create uncertainty about whether this feature is still desired or relevant in current snapcraft versions.
Impact:
50
Quick Win:
32.5
Staleness:
85
Complexity:
35
Confidence:
55
Support Request:
15
Issue body
snapcraft version: 7.2.9, rev 8619
snapcraft.yaml content:
package-repositories:
- type: apt
architectures: [arm64]
components: [main]
suites: [jammy]
key-id: <PPA ID>
url: https://${PPA_ACCESS_TOKEN}@private-ppa.launchpadcontent.net/<team>/<project>/ubuntu
Build command:
sudo env PPA_ACCESS_TOKEN="<account>:<token>" SNAPCRAFT_BUILD_ENVIRONMENT="host" snapcraft
Problem:
Since the PPA token is sensitive information for account permission.
In general, we will not put the token content into snapcraft.yaml directly and use an environment parameter to provide the token content.
We found the 'url' of 'package-repositories' can't handle token from the environment variable.
The snapcraft create /etc/apt/sources.list.d/snapcraft-https_PPA_ACCESS_TOKEN_private_ppa_launchpadcontent..._ubuntu.sources directly with "URIs: https://${PPA_ACCESS_TOKEN}@private-ppa.launchpadcontent.net/<team>/<project>/ubuntu"
Is this expected behavior? If yes, could the team make snapcraft support to transfer url with the environment parameter? The reason is we should not put PPA token information from somebody's account and upload it to a public place.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen3.6-35b-a3b-mtp-q6 |
Impact:
50
Quick Win:
32.5
Staleness:
85
Complexity:
35
Confidence:
55
Support Request:
15
|
needs triage | Feature request: snapcraft should expand environment variables in package-repositories URL fields to avoid embedding sensitive PPA tokens in snapcraft.yaml | |
| qwen/qwen3.6-35b-a3b |
Staleness:
98
Complexity:
20
Confidence:
90
Support Request:
10
|
close stale | Request to support environment variable expansion in package-repositories URLs for PPA authentication. Inactive for over 3.5 years with no maintainer response. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
95
Complexity:
40
Confidence:
85
Support Request:
50
|
close stale | snapcraft fails to expand environment variables in package-repositories URLs, writing them literally. Untriaged feature request inactive for over 3 years. | |
| qwen3.6-35b-a3b-mtp-q6 |
Staleness:
90
Complexity:
25
Confidence:
85
Support Request:
10
|
close stale | Requests environment variable expansion in package-repositories URLs to avoid hardcoding PPA tokens. Issue is over 3 years old with no maintainer response or activity. | |
| qwen3.6-35b-a3b-mtp-q6 |
Staleness:
95
Complexity:
20
Confidence:
85
Support Request:
10
|
close stale | Snapcraft fails to expand environment variables in the 'url' field of 'package-repositories', writing literal strings to apt sources. Untriaged and inactive for over 3 years. |
Update history
No update history recorded yet.
Related issues
No related issues found above the similarity threshold.