No support for unsigned package-repositories
Metadata
Current evaluation
Unsigned file:// APT repositories remain unsupported; maintainers agreed to add an `insecure: true` opt-in when `key-id` is absent, but it is not yet implemented.
Suggested action: keep open
Reason: The 2021 maintainer comment established a concrete design: `insecure: true` when `key-id` is absent, initially restricted to file:// repositories. The feature remains valid but unresolved: current documentation still calls `key-id` mandatory, and repository searches found neither `insecure` support nor `trusted=yes` handling.
Evaluated by: mr-cal-bot
Impact:
35
Quick Win:
18
Complexity:
40
Confidence:
92
Actionability:
84
Issue body
My use case is the same as in bug 1918968. I have a local apt repository (file:/// URL) that I'd like to make available via package-repositories. snapcraft currently demands a key-id and a corresponding key (whether available locally in snap/keys/ or from a keyserver). So to use package-repositories in "local mode", I am forced to sign it with a temporary key and provide that to snapcraft.
This seems unnecessary because apt supports a [trusted=yes] option in the sources.list entry.
Expected: snapcraft exposes an option to set [trusted=yes] to pass through to apt.
In the back of my mind I think [trusted=yes] might have recently become the default for file:/// anyway, so it might be sufficient to just stop assuming that a public key always has to be provided. I'm not sure though; if this isn't the case, then I'd like a "trusted: yes" type option under the package-repositories key please.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha |
Impact:
35
Quick Win:
18
Complexity:
40
Confidence:
92
Actionability:
84
|
keep open | Unsigned file:// APT repositories remain unsupported; maintainers agreed to add an `insecure: true` opt-in when `key-id` is absent, but it is not yet implemented. | |
| stealth/space-bunny-alpha |
Impact:
40
Quick Win:
17
Complexity:
50
Confidence:
92
Actionability:
87
|
keep open | Snapcraft still requires key-id for package repositories. A 2021 maintainer agreed to support unsigned file:// repositories with insecure: true, but current source and docs contain no implementation. | |
| qwen/qwen3.6-35b-a3b |
Impact:
30
Quick Win:
14
Complexity:
40
Confidence:
70
Actionability:
80
|
needs triage | Feature request to support unsigned local APT repositories via a 'trusted' option in package-repositories, avoiding mandatory GPG key requirements. | |
| qwen/qwen3.8-27b |
Impact:
35
Quick Win:
21
Staleness:
92
Complexity:
40
Confidence:
55
Support Request:
30
|
needs triage | Feature request: snapcraft package-repositories requires a key-id/key even for local file:/// apt repos; reporter wants a trusted=yes passthrough or to drop the mandatory key. Open since ~2021, zero comments, no labels, no maintainer response. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
98
Complexity:
15
Confidence:
85
Support Request:
10
|
close stale | Request to support unsigned local apt repositories via a trusted option in snapcraft's package-repositories. The issue has been inactive for over five years with no maintainer response. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
95
Complexity:
35
Confidence:
90
Support Request:
10
|
needs triage | Feature request to add a trusted=yes option for unsigned local apt repositories in snapcraft's package-repositories. Unlabelled and untouched for over five years. | |
| qwen3.6-35b-a3b-mtp-q6 |
Staleness:
98
Complexity:
20
Confidence:
85
Support Request:
10
|
close stale | Feature request to support unsigned local apt repositories via package-repositories by exposing a trusted=yes option or removing mandatory key requirements. Untriaged and inactive for over five years. |
Update history
| Date | Change |
|---|---|
| created |
Related work
-
Related To:
snapcraft (launchpad)#1918968
(confidence 95%)
The issue body explicitly states that its use case is the same as bug 1918968.
Related issues
No related issues found above the similarity threshold.