Feature request to formally support importing private keys
Metadata
Current evaluation
Feature request to support importing private snapcraft keys for CI signing without login. Maintainers raised security concerns; reporter asked for recommended setup guidance but received no further response. No labels, no resolution.
Suggested action: keep open
Reason: Maintainers @tonyespy and @mr-cal engaged with security concerns about private key import/export and @mr-cal mentioned considering a configure hook to create ~/.snap/gnupg/, but the reporter's follow-up question about the recommended setup went unanswered. The CI signing use case remains valid and the issue was triaged, so it should stay open pending a decision on the configure hook approach.
Impact:
35
Quick Win:
15.75
Staleness:
72
Complexity:
55
Confidence:
72
Support Request:
25
Issue body
### What needs to get done
See https://forum.snapcraft.io/t/how-to-import-snapcraft-keys-without-logging-in/43716
It is possible to export private snapcraft keys through accessing gpg directly. However, when trying to import the private key on a "clean" system things fail, because snapcraft has not initialized gpg on install. You can "work" around this issue by logging into snapcraft with a "dummy" account and doing any random key-action (such as list-keys), but this doesn't feel like the prettiest solution.
It would be nice if snapcraft supported exporting and importing private keys from its own UI.
Another option would be to extend snap itself to be able to receive a private-key file to sign things rather than just a key name. This might even be better as it would improve clarity on the meaning of the private key; you should be able to use it independent of anything else to sign things.
### Why it needs to get done
Our usecase:
We sign our models etc. from a machine running in CI. We have the private key in a keyvault; in CI the job retrieves this key and imports it into snapcraft before it runs `snap sign ...`.
This is our usual workflow; we create "empty" runners that only have publically available packages installed, and all secrets are injected before doing any signing actions. Because the runners are initialized on the spot, the gpg keychain is always empty.
In addition, I feel like the lack for a clear pathway to use snap keys without logging in creates a false impression that the login and keys are somehow linked.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen/qwen3.8-27b |
Impact:
35
Quick Win:
15.75
Staleness:
72
Complexity:
55
Confidence:
72
Support Request:
25
|
keep open | Feature request to support importing private snapcraft keys for CI signing without login. Maintainers raised security concerns; reporter asked for recommended setup guidance but received no further response. No labels, no resolution. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
85
Complexity:
40
Confidence:
80
Support Request:
30
|
close stale | Feature request to add native import/export support for private GPG keys in snapcraft to streamline CI/CD workflows. Maintainers expressed security concerns and hesitancy to officially support it, with no resolution after over a year of inactivity. | |
| qwen3.6-35b-a3b-mtp-q6 |
Staleness:
85
Complexity:
45
Confidence:
75
Support Request:
30
|
close stale | Feature request to add official private GPG key import/export support for CI/CD workflows. Unlabelled, inactive for ~1.5 years, with maintainers citing security concerns and no agreed implementation path. | |
| qwen3.6-35b-a3b-mtp-q6 |
Staleness:
90
Complexity:
40
Confidence:
85
Support Request:
30
|
close stale | Requests official support for importing private GPG keys in snapcraft to streamline CI/CD signing. Developers are hesitant due to security concerns but are exploring a configure hook to auto-init the GPG directory. The feature remains under discussion. |
Update history
No update history recorded yet.
Related issues
No related issues found above the similarity threshold.