warn if `snapcraft --destructive-mode` is run by non-root user
Metadata
Current evaluation
Resolved by adding a non-root warning for snapcraft destructive mode upstream in craft-application. The implementation was merged via canonical/craft-application#974, fixing permission errors and clarifying requirements.
Suggested action: —
No scores available.
Issue body
### Bug Description
If I run `snapcraft --destructive-mode`, it fails.
### To Reproduce
On a fresh Noble VM:
```
sudo snap install --classic snapcraft
# installs 8.4.3 (12823)
mkdir -p demo/snap
cat > demo/snap/snapcraft.yaml <<EOT
name: demo
version: 1
summary: demo
description: demo
confinement: classic
grade: devel
base: core24
apps:
demo:
command: usr/bin/bash
parts:
demo:
build-attributes: [enable-patchelf]
plugin: nil
stage-packages: [bash]
package-repositories:
- type: apt
url: https://ppa.launchpadcontent.net/racb/experimental3/ubuntu
suites: [noble]
components: [main]
key-id: D4D3DAC83AF800B5BB2C5407691DFAAA8A4EFD6A
EOT
cd demo
snapcraft --destructive-mode
```
Expected results: success
Actual results:
`Unknown error: Failed to install GPG key:
Full execution log: '/home/ubuntu/.local/state/snapcraft/log/snapcraft-20241013-093507.964064.log'`
### Environment
Ubuntu 24.04 cloud image, snapcraft in destructive mode. Snapcraft snap 8.4.3 (12823).
### snapcraft.yaml
```yaml
name: demo
version: 1
summary: demo
description: demo
confinement: classic
grade: devel
base: core24
apps:
demo:
command: usr/bin/bash
parts:
demo:
build-attributes: [enable-patchelf]
plugin: nil
stage-packages: [bash]
package-repositories:
- type: apt
url: https://ppa.launchpadcontent.net/racb/experimental3/ubuntu
suites: [noble]
components: [main]
key-id: D4D3DAC83AF800B5BB2C5407691DFAAA8A4EFD6A
```
### Relevant log output
```shell
2024-10-13 09:35:07.964 Starting snapcraft, version 8.4.3
2024-10-13 09:35:07.964 Log verbosity level set to BRIEF
2024-10-13 09:35:07.964 Preparing application...
2024-10-13 09:35:07.965 Configuring application...
2024-10-13 09:35:07.966 Setting up ConfigService
2024-10-13 09:35:07.992 Build plan: platform=None, build_for=None
2024-10-13 09:35:07.992 Not running managed mode because `--destructive-mode` was passed
2024-10-13 09:35:07.992 Loading project because a directory was not provided.
2024-10-13 09:35:07.993 Loading project file '/home/ubuntu/demo/snap/snapcraft.yaml'
2024-10-13 09:35:08.049 Processing grammar (on amd64 for amd64)
2024-10-13 09:35:08.049 Processing grammar for build-attributes: ['enable-patchelf']
2024-10-13 09:35:08.050 Processing grammar for plugin: nil
2024-10-13 09:35:08.050 Processing grammar for stage-packages: ['bash']
2024-10-13 09:35:08.056 Running snapcraft pack on host
2024-10-13 09:35:12.446 Initialising lifecycle manager in /home/ubuntu/demo
2024-10-13 09:35:12.463 Project vars: {'version': '1', 'grade': 'devel'}
2024-10-13 09:35:12.463 Adopting part: None
2024-10-13 09:35:12.467 Using parallel build count of 1 from CPU count
2024-10-13 09:35:12.473 is_snap: True, SNAP_NAME set to snapcraft
2024-10-13 09:35:12.563 Keyring file not found: /etc/apt/keyrings/craft-8A4EFD6A.gpg
2024-10-13 09:35:12.564 Executing command: ['gpg', '--batch', '--no-default-keyring', '--with-colons', '--keyring', 'gnupg-ring:/etc/apt/keyrings/craft-8A4EFD6A.gpg', '--homedir', '/tmp/tmpp4tvfp0_', '--keyserver', 'keyserver.ubuntu.com', '--recv-keys', 'D4D3DAC83AF800B5BB2C5407691DFAAA8A4EFD6A']
2024-10-13 09:35:12.756 Unknown error: Failed to install GPG key:
2024-10-13 09:35:12.765 Traceback (most recent call last):
2024-10-13 09:35:12.765 File "/snap/snapcraft/12823/lib/python3.10/site-packages/craft_archives/repo/apt_key_manager.py", line 273, in install_key_from_keyserver
2024-10-13 09:35:12.765 _call_gpg(
2024-10-13 09:35:12.765 File "/snap/snapcraft/12823/lib/python3.10/site-packages/craft_archives/repo/apt_key_manager.py", line 56, in _call_gpg
2024-10-13 09:35:12.765 process = subprocess.run(
2024-10-13 09:35:12.765 File "/snap/snapcraft/12823/usr/lib/python3.10/subprocess.py", line 526, in run
2024-10-13 09:35:12.765 raise CalledProcessError(retcode, process.args,
2024-10-13 09:35:12.765 subprocess.CalledProcessError: Command '['gpg', '--batch', '--no-default-keyring', '--with-colons', '--keyring', 'gnupg-ring:/etc/apt/keyrings/craft-8A4EFD6A.gpg', '--homedir', '/tmp/tmpp4tvfp0_', '--keyserver', 'keyserver.ubuntu.com', '--recv-keys', 'D4D3DAC83AF800B5BB2C5407691DFAAA8A4EFD6A']' returned non-zero exit status 2.
2024-10-13 09:35:12.765
2024-10-13 09:35:12.765 During handling of the above exception, another exception occurred:
2024-10-13 09:35:12.765 Traceback (most recent call last):
2024-10-13 09:35:12.765 File "/snap/snapcraft/12823/lib/python3.10/site-packages/craft_application/services/lifecycle.py", line 249, in run
2024-10-13 09:35:12.765 repositories.install_package_repositories(
2024-10-13 09:35:12.765 File "/snap/snapcraft/12823/lib/python3.10/site-packages/craft_application/util/repositories.py", line 51, in install_package_repositories
2024-10-13 09:35:12.765 refresh_required = repo.install(package_repositories, key_assets=key_assets)
2024-10-13 09:35:12.765 File "/snap/snapcraft/12823/lib/python3.10/site-packages/craft_archives/repo/installer.py", line 44, in install
2024-10-13 09:35:12.765 return _install_repos(
2024-10-13 09:35:12.765 File "/snap/snapcraft/12823/lib/python3.10/site-packages/craft_archives/repo/installer.py", line 91, in _install_repos
2024-10-13 09:35:12.765 refresh_required |= key_manager.install_package_repository_key(
2024-10-13 09:35:12.765 File "/snap/snapcraft/12823/lib/python3.10/site-packages/craft_archives/repo/apt_key_manager.py", line 334, in install_package_repository_key
2024-10-13 09:35:12.765 self.install_key_from_keyserver(key_id=key_id, key_server=key_server)
2024-10-13 09:35:12.765 File "/snap/snapcraft/12823/lib/python3.10/site-packages/craft_archives/repo/apt_key_manager.py", line 284, in install_key_from_keyserver
2024-10-13 09:35:12.765 raise errors.AptGPGKeyInstallError(
2024-10-13 09:35:12.765 craft_archives.repo.errors.AptGPGKeyInstallError: Failed to install GPG key:
2024-10-13 09:35:12.765 Full execution log: '/home/ubuntu/.local/state/snapcraft/log/snapcraft-20241013-093507.964064.log'
```
### Additional context
On the other hand, `sudo snapcraft --destructive-mode` works. But the requirement for this isn't documented anywhere (eg. no mention at https://snapcraft.io/docs/build-options where `--destructive-mode` is documented). I assume this requirement is not intended? Otherwise `snapcraft --destructive-mode` should simply fail to run immediately.
This seems to be a regression between base: core20 and base: core24.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen/qwen3.6-35b-a3b | — | — | Resolved by adding a non-root warning for snapcraft destructive mode upstream in craft-application. The implementation was merged via canonical/craft-application#974, fixing permission errors and clarifying requirements. | |
| qwen/qwen3.6-35b-a3b | — | — | Resolved upstream in canonical/craft-application#974. Implemented a warning when running snapcraft in destructive mode as a non-root user to clarify permission requirements and prevent confusing GPG key installation failures. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Resolved upstream in craft-application via PR #974. The enhancement now warns when snapcraft --destructive-mode runs as a non-root user, clarifying permission requirements and preventing confusing GPG failures. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Resolved upstream in craft-application PR #974. The enhancement adds a warning when snapcraft runs in destructive mode as a non-root user, clarifying permission requirements and preventing confusing GPG key installation errors. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #4558 Provide better errors for failures to clear the apt cache | snapcraft | closed | Superseded by snapcraft 8.14, which now warns when running destructive mode as a non-root user. The related improvement was merged in canonical/craft-application#974, providing clearer guidance for cache permission issues. |