Snap app names are too permissive
Metadata
Current evaluation
Fixed: snapcraft PR #555 (commit bc9fac7e7) tightened snap/app name validation to match snapd, with snapd PR snapcore/snapd#1280; shipped in snapcraft 2.12 (xenial/yakkety) and verified.
Resolution: closed resolved
Reason: Merged commit bc9fac7e7 ("Make app names more restrictive", PR #555) added stricter app-name validation, paired with snapcore/snapd#1280. The fix shipped in snapcraft 2.12, was SRU-verified by ~elopio on xenial -proposed, and the bug was marked verification-done.
Evaluated by: mr-cal-bot
No scores available.
Issue body
Currently snapd accepts app names that can cause issues in the rest of the system (e.g. invalid apparmor profiles like "myapp/", or clashing with hook names). These should be more restrictive: the current recommendation is `^[a-zA-Z0-9](?:-?[a-zA-Z0-9])*$`.
[Impact]
* snaps with invalid names are generated and installable.
* blocking problems earlier will make the experience better.
[Test Case]
* For snapcraft: make a snapcraft.yaml with an invalid name, and run snapcraft.
* For snappy: make a snap with an invalid name, and try to install it.
[Regression Potential]
* Valid names could be affected. Run some tests on valid names too.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Fixed: snapcraft PR #555 (commit bc9fac7e7) tightened snap/app name validation to match snapd, with snapd PR snapcore/snapd#1280; shipped in snapcraft 2.12 (xenial/yakkety) and verified. | |
| stealth/space-bunny-alpha | — | closed resolved | Resolved by stricter snap app-name validation in snapd PR #1280 and snapcraft PR #555 (bc9fac7e7); snapcraft 2.12 was released and verified. | |
| stealth/space-bunny-alpha | — | closed resolved | Fixed by merged canonical/snapcraft#555 (bc9fac7e7), tightening app-name validation to match snapd and prevent invalid AppArmor profiles and hook-name clashes. | |
| stealth/space-bunny-alpha | — | closed resolved | Snapcraft tightened snap app-name validation to match snapd, blocking invalid AppArmor names and hook-name clashes. Merged in canonical/snapcraft#555 (bc9fac7e7). | |
| qwen/qwen3.6-35b-a3b | — | — | Fixed by enforcing stricter snap app name validation using the proposed regex. This prevents invalid AppArmor profiles and hook name clashes. The change was verified and the issue closed. | |
| qwen/qwen3.6-35b-a3b | — | — | Stricter snap app name validation was implemented to prevent invalid AppArmor profiles and hook clashes. The fix enforces the recommended alphanumeric pattern, was marked verification-done, and the issue was closed. |
Update history
| Date | Change |
|---|---|
| created |
Related work
-
Likely Fixed By:
snapcraft#555
(confidence 95%)
Merged as commit bc9fac7e7; restrict app names in snapcraft to match snapd.
-
Related To:
snapd#1280
(confidence 85%)
Upstream snapd fix cited in the issue comments as the paired change.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #555 Make app names more restrictive. | snapcraft | merged | Merged as bc9fac7e7: snapcraft tightened app-name validation to match snapd, preventing hook-name clashes and invalid AppArmor profiles; LP #1589613 was resolved. | |
| #1763048 Snap names regexes are inconsistent or too permissive | snapcraft (launchpad) | open | Cross-project request to make snap-name validation consistent (no one-char names, no leading/trailing/double dashes). Resolved upstream: snapd added the min-length-2 check (snapd PR #6154, commit 362784dc); tracker marked fix released in 2019 but bug still shows open. | |
| #1590620 snapcraft can generage snaps with a name longer than 107 characters | snapcraft (launchpad) | open | Snapcraft still accepts overlong snap names during project validation, allowing builds that the Store later rejects; the maintainer discussed shorter limits, but global enforcement is absent. | |
| #1644673 Trying to register a snap name with reserved characters fails opaquely | snapcraft (launchpad) | closed | Invalid snap names now produce a detailed allowed-character error. The handling landed in PR #1247 (03105a6c4), and Snapcraft v2.34 was confirmed to display it. | |
| #1693798 snapcraft builds a snap that won't install if + is in the name | snapcraft (launchpad) | closed | Fixed by merged snapcore/snapcraft#1622 (commit 066d6e757), which synchronized snap-name validation with snapd and rejected '+' in snap names. | |
| #1751447 snapstore and review-tools use the wrong regexp for snap names | snapcraft (launchpad) | closed | Snap-name validation was fixed by merged PR snapcraft#1957 (commit b950c66a2), removing exponential regex behavior, enforcing the 40-character limit, and improving errors. |