One of the things we want to do with store checks is to make sure that the squashfs is not crafted in a way that might allow exploiting kernel vulnerabilities. It was decided some time ago that how we would handle this is that the store would take the original snap create a checksum, unsquash it then create another snap from the unsquashed directory, then create a checksum of that. If the original checksum and the resquashed snap's checksum match, then everything is ok. In order for the checksums to match though, we need to be sure that the resquashing doesn't introduce unintended changes that would affect the checksum. Today's squashfs-tools has been updated to allow extracting the timestamp from the original squashfs so that it may be used when requashing the snap. What remains is adjusting snapcraft to call mksquashfs with options that will help ensure the squashfs can be resquashed and verified. In order to do this, please adjust snapcraft to call mksquashfs with '-all-root' and '-no-xattrs' (the latter isn't strictly needed, but is a safety net to guard against people trying to circumvent the system).