← Back to issue list

Snap names regexes are inconsistent or too permissive

View original Launchpad issue

Metadata

Project
snapcraft (launchpad)
Number
#1763048
Type
issue
State
open
Author
~adam-collard
Labels
—
Created
Updated
Closed
—

Current evaluation

Cross-project request to make snap-name validation consistent (no one-char names, no leading/trailing/double dashes). Resolved upstream: snapd added the min-length-2 check (snapd PR #6154, commit 362784dc); tracker marked fix released in 2019 but bug still shows open.

Suggested action: close resolved

Reason: The reporter explicitly scoped snapcraft out ("Snapcraft does not seem to enforce any regex ... I think we can leave this as is"), and the actual gap was closed elsewhere: jdstrand noted "The minimum length check is now implemented in trunk" and mvo/zya cited snapd commit 362784dc523520b8257450664a76f507dc28a4e0 plus snapcore/snapd#6154 (min length of 2), after which zyga marked the task fix released. Snapcraft's modern pydantic model (snapcraft/models/project.py validate_name, used for snap and component names) already enforces the store/snapd regex plus the no-leading/trailing-hyphen and no-double-hyphen rules; only the min-length-2 check is absent there, which is cosmetic since snapd rejects such names at upload time. Only caveat driving the moderate confidence: the Launchpad state is still 'open' despite the fix-released comment.

Evaluated by: mr-cal-bot

Impact: 25 Quick Win: 12 Complexity: 15 Confidence: 72 Actionability: 55

Issue body

Currently, the store restricts snap names to comply with: package_name_re_str = r'^[a-z0-9-]*[a-z][a-z0-9-]*$' The regex above allows snap names of one single char (even '-') being registered. The reviewer tools allow for: r'^[a-z0-9-]*[a-z][a-z0-9-]*$' plus some extra checks (see check_name method in https://bazaar.launchpad.net/~store-reviewers/click-reviewers-tools/trunk/view/head:/clickreviews/sr_lint.py#L173) Snapd allow for: the same regex than the store plus some extra checks, see https://github.com/snapcore/snapd/blob/master/snap/validate.go#L40 Snapcraft does not seem to enforce any regex (or I couldn't find one) -- I think we can leave this as is. We want to ensure snapd, c-r-t and the store are consistent and do not allow one-char snap names being registered, nor having - at the beginning or end of a name, nor -- in it (similar to what snapd does but also restricting the min length).

Evaluation history

Date Model Scores Action Summary
stealth/space-bunny-alpha
Impact: 25
Quick Win: 12
Complexity: 15
Confidence: 72
Actionability: 55
close resolved Cross-project request to make snap-name validation consistent (no one-char names, no leading/trailing/double dashes). Resolved upstream: snapd added the min-length-2 check (snapd PR #6154, commit 362784dc); tracker marked fix released in 2019 but bug still shows open.
stealth/space-bunny-alpha
Impact: 45
Quick Win: 24
Complexity: 40
Confidence: 98
Actionability: 90
close resolved Snap-name validation was inconsistent and allowed one-character names; the minimum-length check was added to snapd in PR #6154 and the task was marked fix released.
qwen/qwen3.6-35b-a3b
Impact: 30
Quick Win: 17
Complexity: 20
Confidence: 60
Actionability: 70
needs triage Request to enforce minimum length for snap names and ensure validation consistency across store, snapd, c-r-t, and snapcraft. Issue has no labels, no maintainer response, 0 comments, and no assignee.
qwen/qwen3.8-27b
Impact: 30
Quick Win: 18
Staleness: 95
Complexity: 40
Confidence: 65
Support Request: 10
needs triage Snap name regexes across the store, click-reviewers-tools, and snapd are inconsistent or too permissive (allowing one-char names, leading/trailing dashes, double dashes); snapcraft itself does not enforce a regex. No maintainer response in ~7 years.
qwen/qwen3.6-35b-a3b
Staleness: 98
Complexity: 65
Confidence: 88
Support Request: 10
close stale Reports inconsistent and overly permissive regex validation for snap names across store, snapd, and reviewer tools. Allows single-character names and invalid hyphen usage. Unlabeled, zero comments, inactive for over six years.
qwen/qwen3.6-35b-a3b
Staleness: 98
Complexity: 75
Confidence: 90
Support Request: 15
close stale Reports inconsistencies in snap name validation regexes across store, snapd, and reviewer tools, requesting stricter rules to prevent single-character or hyphen-prefixed names. Unaddressed for over 8 years.
qwen3.6-35b-a3b-mtp-q6
Staleness: 98
Complexity: 75
Confidence: 90
Support Request: 15
close stale Reports inconsistencies in snap name validation regexes across store, snapd, and review tools, requesting stricter rules to prevent single-char names and invalid dash usage. Issue is inactive for over 6 years with no maintainer response.

Update history

Date Change
created

Related work

  • Likely Fixed By: snapd#6154 (confidence 90%)

    Cited by mvo in the issue as where the minimum length of 2 check was added; snapd rejects one-char snap names at upload/install time.

  • Likely Fixed By: snapcore/snapd@362784dc523520b8257450664a76f507dc28a4e0 (confidence 85%)

    snapd ValidateName length check commit referenced by mvo in the issue comments.

  • Duplicate Of: #1751447 (confidence 45%)

    sergiusens suggested this is a duplicate; chipaca kept it open only because it explicitly mentions the min-length requirement.

Related issues

Issue Project State Summary Similarity
#1589613 Snap app names are too permissive snapcraft (launchpad) closed Fixed: snapcraft PR #555 (commit bc9fac7e7) tightened snap/app name validation to match snapd, with snapd PR snapcore/snapd#1280; shipped in snapcraft 2.12 (xenial/yakkety) and verified.
74%
#1957 schema: improve the snap name's validator snapcraft merged Merged as b950c66a2: snap-name validation now avoids exponential regex behavior, enforces the length limit, and provides clearer errors.
72%
#1751447 snapstore and review-tools use the wrong regexp for snap names snapcraft (launchpad) closed Snap-name validation was fixed by merged PR snapcraft#1957 (commit b950c66a2), removing exponential regex behavior, enforcing the 40-character limit, and improving errors.
71%