snapcraft register-key doesn't use U1 SSO login credentials
Metadata
Current evaluation
2016 report that `snapcraft register-key` re-prompts for U1 SSO login even after `snapcraft login`. Discussed as by-design (fresh modify_account_key-scoped login); current keys.py still deliberately unsets credentials and re-logins.
Suggested action: close not a bug
Reason: cjwatson explicitly declared the behaviour intentional ("Registering a key is a security-sensitive operation and requires independent authentication... we intentionally ensure that there are no persistent credentials that permit registering a new key"), and the current code still encodes this deliberately: StoreRegisterKeyCommand._save_key temporarily unsets SNAPCRAFT_STORE_CREDENTIALS and run() performs a fresh ephemeral client.login(acls=["modify_account_key"]). Sergio's objection that "snapd does not require a macaroon here, as it does not communicate with the store" no longer holds, since modern snapcraft exports the key and calls client.register_key() against the store API directly, so the scoped login is genuinely required. The only residual ask was Sergio's suggestion to "tweak the messaging a bit", and zyga closed the snapd side in 2019 with no follow-up, so no actionable bug remains.
Evaluated by: mr-cal-bot
Issue body
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha |
Impact:
22
Quick Win:
4
Complexity:
45
Confidence:
74
Actionability:
32
|
close not a bug | 2016 report that `snapcraft register-key` re-prompts for U1 SSO login even after `snapcraft login`. Discussed as by-design (fresh modify_account_key-scoped login); current keys.py still deliberately unsets credentials and re-logins. | |
| stealth/space-bunny-alpha |
Impact:
40
Quick Win:
19
Complexity:
45
Confidence:
98
Actionability:
88
|
close resolved | Historical register-key double-login defect was corrected by commit 182e25741 (PR #3809); current code uses an ephemeral modify_account_key-scoped login. | |
| qwen/qwen3.6-35b-a3b |
Impact:
10
Quick Win:
8
Complexity:
10
Confidence:
85
Actionability:
90
|
close resolved | snapcraft register-key intentionally performs ephemeral login with specific ACLs. Issue from snapcraft 2.19 resolved by PR #3809 and subsequent refactoring. | |
| qwen/qwen3.8-27b |
Impact:
25
Quick Win:
15
Staleness:
95
Complexity:
40
Confidence:
60
Support Request:
10
|
close stale | register-key re-prompts for U1 SSO credentials even after a successful snapcraft login, tested on snapcraft 2.19. ~10 years old, unlabelled, 0 comments, no maintainer activity; a near-identical Launchpad bug is also open. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
98
Complexity:
25
Confidence:
90
Support Request:
5
|
close stale | Bug report from 2015 stating snapcraft register-key prompts for U1 SSO credentials instead of using existing login. Unlabelled, no maintainer comments, tested on obsolete snapcraft 2.19. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
98
Complexity:
30
Confidence:
95
Support Request:
10
|
close stale | Reports snapcraft register-key requesting U1 SSO credentials instead of reusing an existing login session. Reported against snapcraft 2.19 with no maintainer interaction or updates in nearly a decade. | |
| qwen3.6-35b-a3b-mtp-q6 |
Staleness:
95
Complexity:
25
Confidence:
90
Support Request:
10
|
close stale | snapcraft register-key fails to reuse existing U1 SSO credentials after login. Report is extremely stale, lacks maintainer response, and references the deprecated 2.19 version. |
Update history
| Date | Change |
|---|---|
| created |
Related work
-
Related To:
snapcraft (launchpad)#1782636
(confidence 55%)
Same symptom from 2017 ("Snapcraft request user to login even if the user is logged in"); its summary states the register-key login path was later corrected by PR #3809, but the current keys.py still performs the deliberate re-login, so the two are thematically linked without this one being fixed.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1782636 Snapcraft request user to login even if the user is logged in | snapcraft (launchpad) | open | UX request: snapcraft register-key re-prompts for login even when already logged in; reporter asks for an explanatory message about the extra ACL-scoped re-auth. Unlabelled, no maintainer response. |