← Back to issue list

Snapcraft does not list keys reported from snapd via External Key Manager

View original Launchpad issue

Metadata

Project
snapcraft (launchpad)
Number
#1996618
Type
issue
State
open
Author
~bugraaydogar
Labels
craft-1804
Created
Updated
Closed
—

Current evaluation

Legacy `snapcraft list-keys` hid keys returned by snapd/External Key Manager when the account had no registered keys; superseded by the craft-app `keys` command and Snapcraft 9 removal of list-keys.

Suggested action: close resolved

Reason: The reporter pinpointed snapcraft_legacy/_store.py:442, but that module no longer exists in the tree (grep for `snapcraft_legacy` returns nothing) after commit 30c9fcd19 "refactor: migrate keys command (#6144)". In snapcraft/commands/keys.py the local-key table is now rendered purely from `_get_usable_keys()` (snapd `snap keys --json`) with a `(not registered)` marker, independent of `account_info['account_keys']`, so snapd/External Key Manager keys are listed even when the account has zero registered keys — exactly the expected output in the report. Additionally, `list-keys` itself is now a removed alias (`StoreListKeysCommand` raises `RemovedCommand`, per docs/release-notes/snapcraft-9-0.rst), so the reported command surface is gone. The one open ambiguity is that the reporter's exact `list-keys` invocation can no longer be reproduced, but the underlying defect is addressed in the replacement command.

Evaluated by: mr-cal-bot

Impact: 28 Quick Win: 20 Complexity: 18 Confidence: 84 Actionability: 88

Issue body

Hi Snapcraft Team, snapcraft does not report the keys that are coming from the snapd if the account has no keys created and registered before. When using my own account, I'm able to see the keys that are created and registered; ``` bugraaydogar@aydogar-ws:~$ snapcraft list-keys Name SHA3-384 fingerprint * uc-signing-key aaa * serial bbb * model ccc - bugra-serial ddd (not registered) - bugra-model eee (not registered) ``` The snapd also returns the mentioned keys above; ``` bugraaydogar@aydogar-ws:~$ snap keys Name SHA3-384 uc-signing-key aaa serial bbb model ccc bugra-serial ddd bugra-model eee ``` After definition of the SNAPD_EXT_KEYMGR, I can fetch the following keys from the external key manager via snapd; ``` bugraaydogar@aydogar-ws:~$ snap keys Name SHA3-384 ubuntu-core-model zzz ubuntu-core-model-prod2 yyy ubuntu-core-model-prod xxx ``` I can also see the output of the snapcraft list-keys. ``` bugraaydogar@aydogar-ws:~/$ snapcraft list-keys Name SHA3-384 fingerprint - ubuntu-core-model zzz (not registered) - ubuntu-core-model-prod2 yyy (not registered) - ubuntu-core-model-prod xxx (not registered) ``` However if there is an account with no keys registered previously, it does not report anything; ``` $ snapcraft list-keys No keys have been registered. See 'snapcraft register-key --help' to register a key. ``` I think this is due to the following code; https://github.com/snapcore/snapcraft/blob/main/snapcraft_legacy/_store.py#L442 I think, we should also cover the case where there is no keys registered to the store but snapd provides the keys. Thanks, Bugra

Evaluation history

Date Model Scores Action Summary
stealth/space-bunny-alpha
Impact: 28
Quick Win: 20
Complexity: 18
Confidence: 84
Actionability: 88
close resolved Legacy `snapcraft list-keys` hid keys returned by snapd/External Key Manager when the account had no registered keys; superseded by the craft-app `keys` command and Snapcraft 9 removal of list-keys.
stealth/space-bunny-alpha
Impact: 40
Quick Win: 29
Complexity: 22
Confidence: 97
Actionability: 93
close resolved Snapcraft’s keys command now lists snapd/External Key Manager keys when no account keys are registered; the legacy list-keys alias was removed in Snapcraft 9.
stealth/space-bunny-alpha
Impact: 32
Quick Win: 26
Complexity: 18
Confidence: 99
Actionability: 98
close resolved External Key Manager keys were hidden when the store had no previously registered keys; the legacy fix merged in PR #4245 into the 7.5 hotfix, but the issue remains open.
qwen3.6-35b-a3b-mtp-q6
Impact: 25
Quick Win: 19
Staleness: 85
Complexity: 25
Confidence: 55
Support Request: 15
close stale snapcraft list-keys fails to show keys from External Key Manager when no keys are registered. Unlabelled, 0 comments, inactive for ~3.2 years.
qwen/qwen3.6-35b-a3b
Staleness: 95
Complexity: 30
Confidence: 75
Support Request: 5
close stale snapcraft list-keys fails to display keys from snapd's External Key Manager when no keys are pre-registered. Points to legacy store code.
qwen/qwen3.6-35b-a3b
Staleness: 95
Complexity: 35
Confidence: 85
Support Request: 15
close stale snapcraft list-keys fails to report keys from snapd's External Key Manager when no keys are pre-registered. Points to legacy code. Inactive for over 3 years with no maintainer response.
qwen3.6-35b-a3b-mtp-q6
Staleness: 95
Complexity: 20
Confidence: 90
Support Request: 5
close stale snapcraft list-keys fails to display keys from snapd's External Key Manager when no keys are pre-registered. Untriaged, inactive for over three years, and references deprecated snapcraft_legacy code.

Update history

Date Change
created

Related work

  • Related To: snapcraft (launchpad)#1720207 (confidence 80%)

    Same symptom family (keys not listed although the user has keys); addressed by the same rewrite of the keys command.

  • Likely Fixed By: canonical/snapcraft#6144 (confidence 72%)

    Commit 30c9fcd19 migrated the keys command to craft-application and rewrote the key listing so local/snapd keys are shown independently of registered account keys.

  • Related To: snapcraft (launchpad)#1858994 (confidence 70%)

    Non-registered local keys hidden when nothing is registered — the same conditional-logic gap this report describes.

Related issues

Issue Project State Summary Similarity
#1720207 snapcraft list-keys returns no keys, but the user has keys snapcraft (launchpad) open Observed behavior is resolved: keys now displays registered remote-only key fingerprints separately from local keys; legacy list-keys was renamed and removed in Snapcraft 9.
81%
#1858994 snapcraft list-keys doesn't show the non-registered key when no key is registered snapcraft (launchpad) open list-keys hid local unregistered keys when no key was registered (snapcraft 3.8). Fixed by 1c44a58fc; today's 'keys' command lists local keys and marks unregistered ones, and list-keys was removed in Snapcraft 9.
80%
#1736864 snapcraft list-keys with no snap keys returns an empty table snapcraft (launchpad) closed Fixed via merged canonical/snapcraft#1784 (commit 5c76509ff): list-keys now shows registration guidance instead of an empty table when no keys exist.
73%
#1622037 snapcraft list-keys prints no message when there are no keys snapcraft (launchpad) closed UX request: `snapcraft list-keys` printed an empty table with no message when no keys existed. Fixed in canonical/snapcraft#1784 (5c76509ff); the command is now also a removed alias for `keys`.
72%
#1621895 Implement `snapcraft list-keys` snapcraft (launchpad) closed snapcraft list-keys was implemented by merged PR snapcore/snapcraft#786 in commit 233adda3a, showing store-account keys alongside local key data.
71%
#1720210 snapcraft list-keys with no keys returns an empty table snapcraft (launchpad) closed Empty-key output was fixed by PR #4245 (commit 1c44a58fc): keys now reports that no keys are registered and points users to register-key help.
70%