Regression: snapcraft "apt" package-repositories feature fails in destructive mode
Metadata
Current evaluation
Fixed in Snapcraft 7.5. The regression causing permission denied errors for /etc/apt/keyrings in destructive mode was resolved by restoring sudo usage for core20. Verified working in 7.5.2 and closed.
Suggested action: —
No scores available.
Issue body
### Bug Description
See #4224 for the background.
I tried dropping subkey generation to work around the issue (it's gpg's interactive default, but not needed for this case). But then I got a further error: `[Errno 13] Permission denied: '/etc/apt/keyrings'`. This is running snapcraft in destructive mode. The "apt" package-repositories used to work fine, but has now regressed. Perhaps snapcraft used to use sudo, but now doesn't?
### To Reproduce
In a Focal lxd container, running as the ubuntu user (eg. `lxc launch ubuntu:focal test-container && lxc shell test-container` and then `login -f ubuntu`):
```
git clone https://git.launchpad.net/git-ubuntu
git checkout 8f0d8e5
```
Modify snap.sh as follows:
```
diff --git a/snap.sh b/snap.sh
index 260a968..7ca6355 100644
--- a/snap.sh
+++ b/snap.sh
@@ -58,8 +58,6 @@ gpg --batch --gen-key <<EOF
%no-protection
Key-Type:1
Key-Length:2048
-Subkey-Type:1
-Subkey-Length:2048
Name-Real: git-ubuntu build script apt repo
Name-Email: ubuntu-devel-discuss@lists.ubuntu.com
Expire-Date:0
```
Then run:
`sh snap.sh`
### Environment
Snapcraft is in destructive mode inside a lxd container.
### snapcraft.yaml
```shell
See https://git.launchpad.net/git-ubuntu/tree/snap/snapcraft.yaml although note that snap.sh modifies it slightly to work around LP: #1918968. See that script for details.
```
### Relevant log output
```shell
Sorry, an error occurred in Snapcraft:
[Errno 13] Permission denied: '/etc/apt/keyrings'
```
### Additional context
_No response_
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen/qwen3.6-35b-a3b | — | — | Fixed in Snapcraft 7.5. The regression causing permission denied errors for /etc/apt/keyrings in destructive mode was resolved by restoring sudo usage for core20. Verified working in 7.5.2 and closed. | |
| qwen/qwen3.6-35b-a3b | — | — | Fixed in Snapcraft 7.5.2. The regression causing permission denied errors for /etc/apt/keyrings in destructive mode was resolved by restoring sudo usage for core20. The author verified the fix and merged the reverted workaround. | |
| qwen/qwen3.6-35b-a3b | — | — | Fixed in Snapcraft 7.5.2 by restoring sudo usage for core20 destructive mode, resolving the /etc/apt/keyrings permission denied regression. The reporter verified the fix, reverted their workaround, and the issue was closed. | |
| qwen/qwen3.6-35b-a3b | — | — | Regression causing permission denied errors for apt keyrings in destructive mode was fixed in Snapcraft 7.5.2 by restoring required sudo handling. The author verified the fix, and the issue was closed. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Fixed in Snapcraft 7.5. The regression causing permission denied errors for /etc/apt/keyrings in destructive mode was resolved by restoring sudo usage for core18 and core20. The reporter confirmed the fix in 7.5.2 and reverted their workaround. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Fixed in snapcraft 7.5.2. A regression in 7.3.2 removed sudo usage in destructive mode, causing permission denied errors for /etc/apt/keyrings. The change was reverted, restoring functionality. Reporter confirmed the fix and closed the issue. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #4224 Regression: snapcraft started failing with craft_archives.repo.errors.AptGPGKeyInstallError | snapcraft | closed | A snapcraft regression causing AptGPGKeyInstallError from multi-key files was fixed. Resolution updated key parsing logic, with a hotfix released in version 7.4.4 and merged via PR #4241. The issue is closed. |