package-repositories key filename uses wrong end of fingerprint
Metadata
Current evaluation
Resolved on edge by snapcore/snapcraft#3486; key filenames now use the fingerprint’s last eight characters, and the documentation was updated.
Resolution: closed resolved
Reason: The maintainer confirmed the accepted change and linked resolving PR snapcore/snapcraft#3486, noting it was addressed on edge. Existing package-repository fixtures also use the fingerprint suffix, such as 9E61EF26.asc.
Evaluated by: mr-cal-bot
No scores available.
Issue body
According to https://snapcraft.io/docs/package-repositories#heading--keyid, "Snapcraft will install a corresponding key at <project>/snap/keys/590CA3D8.asc"
This is confusing, since the gpg convention is to use the *last* hex digits of a fingerprint as a key id. So for a key id 590CA3D8E4826565BE3200526A634116E00F4C82, I'd expect an eight digit shortening to be E00F4C82.asc, not 590CA3D8.asc.
For example, let's say that I have the key in my local keyring but want to add it to snap/keys/.
Expected command to use:
gpg --export -a E00F4C82 > E00F4C82.asc
Actual command I have to use:
gpg --export -a E00F4C82 > 590CA3D8.asc
Please use <project>/snap/keys/<key-id[-8:]>.asc instead of <project>/snap/keys/<key-id[:8]>.asc to match up with the PGP ecosystem's use of "key ID" to mean a right-aligned shortening of the key fingerprint.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Resolved on edge by snapcore/snapcraft#3486; key filenames now use the fingerprint’s last eight characters, and the documentation was updated. | |
| stealth/space-bunny-alpha | — | closed resolved | Maintainer agreed snap/keys/*.asc should use the last 8 hex digits of the GPG fingerprint, and fixed it on edge: merged PR canonical/snapcraft#3486 (commit 83d54e58a), docs updated on snapcraft.io. | |
| stealth/space-bunny-alpha | — | closed resolved | Fixed by merged PR #3486 (commit 83d54e58a): package-repository .asc key files now use the last eight fingerprint characters. | |
| qwen/qwen3.6-35b-a3b | — | — | Abandoned. Snapcraft continues using the first eight hex digits of GPG fingerprints for key filenames. The request was closed without resolution or implementation. | |
| qwen/qwen3.6-35b-a3b | — | — | Closed as abandoned. Snapcraft retains the first 8 fingerprint digits for key filenames, diverging from PGP standards. No fix or discussion was recorded. | |
| qwen/qwen3.6-35b-a3b | — | — | Closed without resolution. The report highlighted that Snapcraft uses the first eight digits of a GPG fingerprint for key filenames instead of the standard last eight digits. No comments or fixes were provided. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Closed without resolution. The report noted Snapcraft incorrectly uses the first eight fingerprint digits for key filenames instead of the standard last eight. No fix was implemented or discussed. |
Update history
| Date | Change |
|---|---|
| created |
Related work
-
Likely Fixed By:
snapcore/snapcraft#3486
(confidence 99%)
The linked PR changed package-repository key asset naming to use the final eight fingerprint characters.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #3486 package-repositories: use last 8 characters of key id for .asc | snapcraft | merged | Merged PR canonical/snapcraft#3486 (commit 83d54e58a) by cjp256: snap/keys/*.asc package-repository key files now use the last 8 chars of the GPG key ID, aligning with gpg/apt-key. Fixes LP #1918967. |