← Back to issue list

snapcraft part sources are not verified for authenticity

View original Launchpad issue

Metadata

Project
snapcraft (launchpad)
Number
#1626632
Type
issue
State
open
Author
~cmiller
Labels
—
Created
Updated
Closed
—

Current evaluation

Feature request (2016) to verify authenticity of downloaded part sources via GPG signer keys; still unimplemented — craft-parts/snapcraft only support source-checksum integrity, no source-signer-keys support. Maintainer agreed in 2016.

Suggested action: keep open

Reason: The feature was never implemented: grepping both snapcraft and craft-parts finds zero matches for 'source-signer-keys', and only integrity (not authenticity) verification exists via craft_parts/sources/checksum.py, documented in docs/explanation/cryptography.rst as 'the checksum is verified using hashlib'. Maintainer ~sergiusens responded 'Sounds good.' in 2016 and ~mwhudson pinged in 2018 without resolution, so the request remains valid and unimplemented. It is not stale/obsolete: source handling still exists (craft_parts/sources/), and checksums remain optional and opt-in. Scores are moderated because the design is only sketched (gpg .asc for tar/zip, signed commits for git/bzr, unspecified for hg/svn, 32-bit key-ID warnings) and implementation would now belong in craft-parts rather than snapcraft, so scope needs re-confirmation.

Evaluated by: mr-cal-bot

Impact: 45 Quick Win: 9 Complexity: 62 Confidence: 85 Actionability: 52

Issue body

As we well know in the world of Ubuntu/Debian, critical resources are often served over unauthenticated, unencrypted streams, and later verified with cryptographic signatures. That we do this our only justification for continuing to use cleartext protocols like HTTP to serve images and such. We think it's important and obvious. snapcraft does not check if a downloaded source is verified before using that source and obscuring its contents. I think almost every source type could be verified. Example:     plugin: autotools     source: https://www.torproject.org/dist/tor-0.2.8.7.tar.gz     source-signer-keys: [ 0x28988BF5, 0x19F78451, 0x165733EA, 0x8D29319A ] For a zipfiles or tarballs, the steps are obvious. Also download source + ".asc". Check if it's signed with any of the keys whose IDs are in the signers list and that the signature matches content. "gpg --verify sourcefile.asc sourcefile" For bzr and git, verify that the most recent commit is signed with any such key. For PPAs, verify that they are signed with keys (perhaps already handled by APT). That leaves hg and svn, which I don't know enough about, and local, which doesn't make sense. (Incidentally, print warnings to discourage listing 32-bit ids like example uses. They're too weak.)

Evaluation history

Date Model Scores Action Summary
stealth/space-bunny-alpha
Impact: 45
Quick Win: 9
Complexity: 62
Confidence: 85
Actionability: 52
keep open Feature request (2016) to verify authenticity of downloaded part sources via GPG signer keys; still unimplemented — craft-parts/snapcraft only support source-checksum integrity, no source-signer-keys support. Maintainer agreed in 2016.
stealth/space-bunny-alpha
Impact: 68
Quick Win: 9
Complexity: 76
Confidence: 91
Actionability: 58
keep open Acknowledged request to authenticate part sources; craft-parts supports checksum integrity but no signer-key verification, leaving GPG authenticity checks unimplemented.
qwen/qwen3.6-35b-a3b
Impact: 35
Quick Win: 7
Complexity: 65
Confidence: 70
Actionability: 55
needs triage Feature request to add GPG signature verification for downloaded sources (source-signer-keys). Unimplemented and untriaged after ~10 years.
qwen/qwen3.8-27b
Impact: 55
Quick Win: 15
Staleness: 92
Complexity: 72
Confidence: 70
Support Request: 5
needs triage Feature request to add GPG signature verification for snapcraft part sources (source-signer-keys). Open ~10 years with 0 comments, no labels, no maintainer interaction; feature never implemented in current codebase.
qwen/qwen3.6-35b-a3b
Staleness: 98
Complexity: 70
Confidence: 90
Support Request: 10
close stale Feature request to add GPG signature verification for snapcraft sources. Unaddressed for nearly a decade with no maintainer interaction or activity.
qwen/qwen3.6-35b-a3b
Staleness: 95
Complexity: 60
Confidence: 70
Support Request: 0
needs triage Feature request to add cryptographic signature verification for snapcraft part sources. Open for ~10 years with zero maintainer interaction, labels, or comments.
qwen3.6-35b-a3b-mtp-q6
Staleness: 98
Complexity: 75
Confidence: 80
Support Request: 5
close stale Feature request to add cryptographic verification for snapcraft build sources across multiple formats. Unlabelled, zero comments, and inactive for nearly eight years.

Update history

Date Change
created

Related issues

Issue Project State Summary Similarity
#1585913 Snapcraft should allow the user to verify downloaded files with a checksum snapcraft (launchpad) closed Checksum verification landed in canonical/snapcraft PR #980 (commit 3e9c4d381), adding algorithm-qualified source-checksum validation for tar, zip, deb, and rpm sources.
73%