Regression: snapcraft "apt" package-repositories feature fails in destructive mode
Metadata
Current evaluation
Regression in the 'apt' package-repositories plugin (destructive-mode /etc/apt/keyrings permission error) was fixed by reverting the craft-archives migration in commit 706872ec5, shipped in Snapcraft 7.5; reporter confirmed 7.5.2 works and the issue was closed.
Resolution: closed resolved
Reason: Tigarmo traced the regression to commit ce23bc7d1 ('repo: migrate to craft-archives', #4037), which dropped the 'sudo' handling needed for core20 destructive mode; it was reverted in commit 706872ec5 and released in Snapcraft 7.5. The reporter confirmed the fix on 7.5.2 and tigarmo closed the issue.
Evaluated by: mr-cal-bot
No scores available.
Issue body
### Bug Description
See #4224 for the background.
I tried dropping subkey generation to work around the issue (it's gpg's interactive default, but not needed for this case). But then I got a further error: `[Errno 13] Permission denied: '/etc/apt/keyrings'`. This is running snapcraft in destructive mode. The "apt" package-repositories used to work fine, but has now regressed. Perhaps snapcraft used to use sudo, but now doesn't?
### To Reproduce
In a Focal lxd container, running as the ubuntu user (eg. `lxc launch ubuntu:focal test-container && lxc shell test-container` and then `login -f ubuntu`):
```
git clone https://git.launchpad.net/git-ubuntu
git checkout 8f0d8e5
```
Modify snap.sh as follows:
```
diff --git a/snap.sh b/snap.sh
index 260a968..7ca6355 100644
--- a/snap.sh
+++ b/snap.sh
@@ -58,8 +58,6 @@ gpg --batch --gen-key <<EOF
%no-protection
Key-Type:1
Key-Length:2048
-Subkey-Type:1
-Subkey-Length:2048
Name-Real: git-ubuntu build script apt repo
Name-Email: ubuntu-devel-discuss@lists.ubuntu.com
Expire-Date:0
```
Then run:
`sh snap.sh`
### Environment
Snapcraft is in destructive mode inside a lxd container.
### snapcraft.yaml
```shell
See https://git.launchpad.net/git-ubuntu/tree/snap/snapcraft.yaml although note that snap.sh modifies it slightly to work around LP: #1918968. See that script for details.
```
### Relevant log output
```shell
Sorry, an error occurred in Snapcraft:
[Errno 13] Permission denied: '/etc/apt/keyrings'
```
### Additional context
_No response_
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Regression in the 'apt' package-repositories plugin (destructive-mode /etc/apt/keyrings permission error) was fixed by reverting the craft-archives migration in commit 706872ec5, shipped in Snapcraft 7.5; reporter confirmed 7.5.2 works and the issue was closed. | |
| stealth/space-bunny-alpha | — | closed resolved | Fixed in Snapcraft 7.5: sudo-based apt key handling was restored for core20 destructive mode. The reporter confirmed 7.5.2 worked, prompting closure. | |
| qwen/qwen3.6-35b-a3b | — | — | Fixed in Snapcraft 7.5. The regression causing permission denied errors for /etc/apt/keyrings in destructive mode was resolved by restoring sudo usage for core20. Verified working in 7.5.2 and closed. | |
| qwen/qwen3.6-35b-a3b | — | — | Fixed in Snapcraft 7.5.2. The regression causing permission denied errors for /etc/apt/keyrings in destructive mode was resolved by restoring sudo usage for core20. The author verified the fix and merged the reverted workaround. | |
| qwen/qwen3.6-35b-a3b | — | — | Fixed in Snapcraft 7.5.2 by restoring sudo usage for core20 destructive mode, resolving the /etc/apt/keyrings permission denied regression. The reporter verified the fix, reverted their workaround, and the issue was closed. | |
| qwen/qwen3.6-35b-a3b | — | — | Regression causing permission denied errors for apt keyrings in destructive mode was fixed in Snapcraft 7.5.2 by restoring required sudo handling. The author verified the fix, and the issue was closed. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Fixed in Snapcraft 7.5. The regression causing permission denied errors for /etc/apt/keyrings in destructive mode was resolved by restoring sudo usage for core18 and core20. The reporter confirmed the fix in 7.5.2 and reverted their workaround. |
Update history
No update history recorded yet.
Related work
-
Likely Fixed By:
snapcraft#4037
(confidence 90%)
The original 'repo: migrate to craft-archives' change; reverted by 706872ec5, which restored the sudo-based apt key handling.
-
Related To:
snapcraft#4224
(confidence 80%)
The background issue for the same apt package-repositories regression; fixed separately by PR #4253 in the 7.4.4 hotfix.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #4224 Regression: snapcraft started failing with craft_archives.repo.errors.AptGPGKeyInstallError | snapcraft | closed | Multi-key APT GPG parsing regression was fixed by merged PR #4253 (a311e7c), updating craft-archives and shipping in the Snapcraft 7.4.4 hotfix. |