store: support for more granular store permissions
Metadata
Current evaluation
PR #1958 by cprov merged as commit 5e6316ba0, adding fine-grained Store ACLs (package_register/push/release/metrics/update) for export-login while keeping package_upload macaroons working; docs note in 3.0.1 was incomplete.
Resolution: closed resolved
Reason: The PR was approved and merged into master as commit 5e6316ba0 ('store: support for more granular store permissions (#1958)'). The default ACL list in snapcraft/store/client.py now requests the granular package_* permissions, and snapcraft/storeclient.py's enable-ci travis integration picked up the same set; existing package_upload macaroons remain valid.
Evaluated by: mr-cal-bot
No scores available.
Issue body
- [x] Have you followed the [guidelines for contributing](https://github.com/snapcore/snapcraft/blob/master/CONTRIBUTING.md)?
- [x] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)?
- [x] If this is a bugfix. Have you checked that there is a bug report open for the issue you are trying to fix on [bug reports](https://bugs.launchpad.net/snapcraft)?
- [x] If this is a new feature. Have you discussed the design on the [forum](https://forum.snapcraft.io)?
- [x] Have you successfully run `./runtests.sh static`?
- [x] Have you successfully run `./runtests.sh unit`?
-----
This change will be released to the production Store on 26th Feb. and is part of a general effort to hardening uploads and related permissions. See https://forum.snapcraft.io/t/isv-questions-about-signing-a-snap/2546 for further steps.
New users of the `enable-ci travis` integration will automatically benefit of this feature, existing users will need to run `enable-ci travis --refresh`.
User of `export-login` will be able to specific fine-grained acls as `package_register, package_push, package_release, package_metrics, package_update` (the most appropriate combination) instead of `package_upload`.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | PR #1958 by cprov merged as commit 5e6316ba0, adding fine-grained Store ACLs (package_register/push/release/metrics/update) for export-login while keeping package_upload macaroons working; docs note in 3.0.1 was incomplete. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged as commit 5e6316ba0 via PR #1958, adding granular Store ACLs for export-login while retaining backward compatibility with package_upload macaroons. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged after production deployment. Adds fine-grained ACL support for store permissions, replacing the broad package_upload permission with specific options like package_register and package_push for improved security. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged to implement granular store permissions for export-login and CI integrations. Introduces fine-grained ACLs while preserving backward compatibility with existing package_upload macaroons. Landed after confirming production deployment and test retries. |
Update history
No update history recorded yet.
Related issues
No related issues found above the similarity threshold.