snap does not support revocation of signing keys
Metadata
Current evaluation
Model assertions can be signed with a local key, but Snapcraft exposes no revocation workflow; after 3,179 days it remains open, unlabeled, and without maintainer input.
Suggested action: needs triage
Reason: The report provides a seven-step reproducer and explicitly concludes, "There is no way to revoke the created key." It has no labels, comments, or maintainer response, while the current key commands cover creation, listing, registration, and build signing but not revocation; no resolving commit was found.
Evaluated by: mr-cal-bot
Impact:
48
Quick Win:
14
Complexity:
55
Confidence:
78
Actionability:
64
Issue body
snapcraft signing model assertion process does not support revocation of the signing keys.
How to reproduce:
1) Login snapcraft
> snapcraft login
2) Create default key (need to be done only once)
> snapcraft create-key
3) Generate timestamp
> date -Iseconds --utc
4) Copy the result of date into the timestamp field of the model file e.g. board-model.json
5) Log into your account and copy "Snap account-id" into both the "authority-id"
and the "brand-id" fields in the file board-model.json:
https://dashboard.snapcraft.io/dev/account/
6) Create a new model assertion by running:
> cat board-model.json | snap sign -k default &> board.model
7) There is no way to revoke the created key.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha |
Impact:
48
Quick Win:
14
Complexity:
55
Confidence:
78
Actionability:
64
|
needs triage | Model assertions can be signed with a local key, but Snapcraft exposes no revocation workflow; after 3,179 days it remains open, unlabeled, and without maintainer input. | |
| qwen/qwen3.6-35b-a3b |
Impact:
20
Quick Win:
8
Complexity:
30
Confidence:
75
Actionability:
60
|
close not a bug | Feature request to add key revocation support to snapcraft; key revocation is handled via snap command or Ubuntu Store web interface instead. | |
| qwen/qwen3.8-27b |
Impact:
30
Quick Win:
14
Staleness:
95
Complexity:
55
Confidence:
55
Support Request:
30
|
needs triage | Reports that snapcraft's model assertion signing process (snap sign) provides no way to revoke signing keys. 8.6 years old with zero comments, no labels, and no maintainer interaction; unverified whether the store now supports key revocation. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
98
Complexity:
65
Confidence:
85
Support Request:
20
|
close stale | Feature request stating snapcraft lacks signing key revocation. Open for over 8 years with no maintainer response. The described workflow and missing functionality are irrelevant to current project versions. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
98
Complexity:
75
Confidence:
70
Support Request:
10
|
close stale | Reports inability to revoke snapcraft signing keys used for model assertions. Unlabeled, no maintainer interaction, and inactive for over 8 years. | |
| qwen3.6-35b-a3b-mtp-q6 |
Staleness:
95
Complexity:
75
Confidence:
85
Support Request:
10
|
needs triage | Snapcraft lacks a mechanism to revoke signing keys used for model assertions. Open for over 8 years with no maintainer response or comments. |
Update history
| Date | Change |
|---|---|
| created |
Related issues
No related issues found above the similarity threshold.