More attributes for the squashfs'ed snap
Metadata
Current evaluation
Merged PR #334 via e93fcc0a8, adding mksquashfs -all-root and -no-xattrs to improve snap security and reproducibility.
Resolution: closed resolved
Reason: PR #334 was merged into main as e93fcc0a8, with implementation commit 7df2fe5a2 adding both SquashFS options and resolving LP #1546821.
Evaluated by: mr-cal-bot
No scores available.
Issue body
To make security better and easier to recreate snaps
we need to add -all-root, we also add -no-xattrs since
it is also an improvement that helps in preventing
people trying to circumvent the system.
LP: #1546821
Signed-off-by: Sergio Schvezov sergio.schvezov@ubuntu.com
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Merged PR #334 via e93fcc0a8, adding mksquashfs -all-root and -no-xattrs to improve snap security and reproducibility. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged PR #334 (merge commit e93fcc0a8), adding mksquashfs -all-root and -no-xattrs to improve snap security and reproducibility. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged PR #334 via commit 7df2fe5a2, adding -all-root and -no-xattrs to Squashfs creation to improve security and reproducible resquashing; closed LP #1546821. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged. Added -all-root and -no-xattrs flags to squashfs snap packaging to enhance security and reproducibility. Changes approved by maintainers and successfully integrated. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Added -all-root and -no-xattrs flags to squashfs packaging to improve snap security and reproducibility. Approved by maintainers and Jamie, then merged. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1546821 please add -all-root and -no-xattrs to mksquashfs options | snapcraft (launchpad) | closed | Fixed by merged snapcraft PR #334 (e93fcc0a8), adding mksquashfs -all-root and -no-xattrs for safer, reproducible SquashFS output. | |
| #544 fix(i/snap): don't reject non-snap squashfs files | fetch-service | merged | Merged PR #544 as commit e8bdea8, updating snap inspection to ignore non-snap SquashFS files instead of rejecting them; all CI checks passed. |