Snapcraft should allow the user to verify downloaded files with a checksum
Metadata
Current evaluation
Checksum verification landed in canonical/snapcraft PR #980 (commit 3e9c4d381), adding algorithm-qualified source-checksum validation for tar, zip, deb, and rpm sources.
Resolution: closed resolved
Reason: PR #980 was merged as commit 3e9c4d381, implementing the requested optional source-checksum property with validation errors and unit and integration tests.
Evaluated by: mr-cal-bot
No scores available.
Issue body
Right now we can't verify that the downloaded tarball is exactly what we expect. Snapcraft should a simple field
source-checksum: <sha256/sha512>
and verify the that the checksum of the downloaded file matches.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Checksum verification landed in canonical/snapcraft PR #980 (commit 3e9c4d381), adding algorithm-qualified source-checksum validation for tar, zip, deb, and rpm sources. | |
| stealth/space-bunny-alpha | — | closed resolved | Checksum verification was implemented with source-checksum in snapcraft/snapcraft#980 (commit 3e9c4d381), covering tar, zip, deb, and rpm sources. | |
| stealth/space-bunny-alpha | — | closed resolved | Added explicit source-checksum validation for tar, zip, deb, and rpm downloads in merged PR #980 (commit 3e9c4d381). | |
| stealth/space-bunny-alpha | — | closed resolved | Added optional source-checksum validation for tar, zip, deb and rpm sources in merged PR canonical/snapcraft#980 (commit 3e9c4d381). | |
| qwen/qwen3.6-35b-a3b | — | — | Abandoned and closed without implementation. The requested source-checksum verification feature was not added due to inactivity. No comments or resolution details were recorded. | |
| qwen/qwen3.6-35b-a3b | — | — | Abandoned. The request to add a source-checksum field for verifying downloaded tarballs was closed without implementation or resolution. | |
| qwen/qwen3.6-35b-a3b | — | — | Feature request for a source-checksum field to verify downloaded files was closed without implementation. With zero comments and no resolution details, the request appears abandoned or superseded by later Snapcraft versions. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Abandoned. The request to add a source-checksum field for verifying downloaded tarballs was closed without implementation or discussion. No resolution or merge details provided. |
Update history
| Date | Change |
|---|---|
| created |
Related work
-
Likely Fixed By:
canonical/snapcraft#980
(confidence 99%)
Merged implementation adding source integrity verification for archive and package sources.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1626632 snapcraft part sources are not verified for authenticity | snapcraft (launchpad) | open | Feature request (2016) to verify authenticity of downloaded part sources via GPG signer keys; still unimplemented — craft-parts/snapcraft only support source-checksum integrity, no source-signer-keys support. Maintainer agreed in 2016. |