stage-snaps not usable with a brand store
Metadata
Current evaluation
Brand-store credentials do not work for stage-snaps/build-snaps in LXD or Multipass; host builds work with absolute credentials, but no resolution is recorded.
Suggested action: keep open
Reason: The reporter provided concrete commands and confirmed with snapcraft 5.0 revision 6751 that absolute credentials work in destructive/host mode but fail in LXD or Multipass because the credential file is unavailable inside the build environment. The proposed serialized-macaroon and snapd-delegation direction makes the problem actionable, but no resolving PR, release, or later verification is documented.
Evaluated by: mr-cal-bot
Impact:
55
Quick Win:
13
Complexity:
70
Confidence:
86
Actionability:
78
Issue body
It's not possible AFAICT to configure snapcraft to download snaps from a brand store with build-snaps or stage-snaps. Poking around at the source, it looks like snapcraft is downloading snaps with this function: https://github.com/snapcore/snapcraft/blob/master/snapcraft/internal/repo/snaps.py#L163-L175
which if I run `snap download` outside of snapcraft I am able to download snaps from my brand store by specifying the env vars:
UBUNTU_STORE_AUTH_DATA_FILENAME=./creds UBUNTU_STORE_ID=my-cool-brand-store-id snap download my-cool-brand-store-snap --edge
(where creds is from snapcraft export-login)
Attempting to provide this env vars to snapcraft doesn't seem to propogate them to the snap download command that snapcraft runs. I.e. this fails:
UBUNTU_STORE_AUTH_DATA_FILENAME=./creds UBUNTU_STORE_ID=my-cool-brand-store-id snapcraft
It also fails in destructive-mode:
UBUNTU_STORE_AUTH_DATA_FILENAME=./creds UBUNTU_STORE_ID=my-cool-brand-store-id snapcraft --destructive-mode
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha |
Impact:
55
Quick Win:
13
Complexity:
70
Confidence:
86
Actionability:
78
|
keep open | Brand-store credentials do not work for stage-snaps/build-snaps in LXD or Multipass; host builds work with absolute credentials, but no resolution is recorded. | |
| stealth/space-bunny-alpha |
Impact:
50
Quick Win:
8
Complexity:
76
Confidence:
85
Actionability:
70
|
keep open | Brand-store authentication cannot be used for build-snaps or stage-snaps in managed LXD/Multipass builds; host builds work with an absolute credentials path, but container propagation remains unresolved. | |
| stealth/space-bunny-alpha |
Impact:
52
Quick Win:
18
Complexity:
48
Confidence:
75
Actionability:
68
|
needs triage | Snapcraft cannot resolve build-snaps or stage-snaps from an authenticated brand store; the reporter’s store environment variables are not propagated, but the unlabelled issue has had no maintainer assessment. | |
| qwen/qwen3.8-27b |
Impact:
35
Quick Win:
16
Staleness:
95
Complexity:
55
Confidence:
70
Support Request:
15
|
needs triage | stage-snaps/build-snaps cannot download snaps from a brand store because snapcraft does not propagate UBUNTU_STORE_ID/UBUNTU_STORE_AUTH_DATA_FILENAME to its internal snap download. Unlabeled, 0 comments, no maintainer activity since ~2021; references long-removed Python-2 code. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
98
Complexity:
40
Confidence:
90
Support Request:
20
|
close stale | Reporter notes snapcraft fails to propagate brand store authentication environment variables to its internal snap download command, breaking build-snaps and stage-snaps usage. Issue has no labels, comments, or maintainer activity. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
95
Complexity:
50
Confidence:
75
Support Request:
10
|
needs triage | Snapcraft fails to propagate brand store authentication environment variables to its underlying snap download command, blocking build/stage-snaps from brand stores. Untriaged with no maintainer response in nearly 7 years. | |
| qwen3.6-35b-a3b-mtp-q6 |
Staleness:
95
Complexity:
40
Confidence:
80
Support Request:
20
|
close stale | snapcraft fails to propagate brand store authentication environment variables to its internal snap download command, breaking build-snaps and stage-snaps. Unlabelled and inactive for over four years. |
Update history
| Date | Change |
|---|---|
| created |
Related work
-
Related To:
snapcraft#3885
(confidence 78%)
Later on-prem store client work is relevant to private-store authentication, but the available history does not show that it fixed containerized build or stage snap downloads.
-
Related To:
snapcraft#3955
(confidence 70%)
Follow-up on-prem credentials-format support is relevant context, without evidence that it resolved the reported build-snaps/stage-snaps failure.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1901733 stage-snaps not usable with branches | snapcraft (launchpad) | closed | Stage/build-snap branch channels were identified as blocked by Snapcraft validation, but no fix landed; the item was eventually abandoned and closed as stale. |