Checksum mismatch error when uploading a snap to the store

[Konrad Zapałowicz]

As of April 12/13 uploading a snap to the store ends with the following error:

Processing...|
Error while processing...
The store was unable to accept this snap.
  - checksums do not match. Please ensure the snap is created with either 'snapcraft snap <DIR>' or 'mksquashfs <dir> <snap> -noappend -comp xz -all-root -no-xattrs -no-fragments'

The snap itself is created with a following line: snapcraft clean && snapcraft

mqsquashfs from squashfs-tools v1:4.3-3ubuntu
snapcraft, version 2.34

The snapcraft.yaml being used:

name: foo
version: 4.4-3-dev
summary: foo
description: foo
grade: stable
confinement: strict
type: kernel
architectures: [armhf]

parts:
  kernel:
    plugin: kernel
    source: .
    kdefconfig: [foo.config]
    kernel-image-target: zImage
    install: |
        set -e
        cd $SNAPCRAFT_PART_INSTALL/
        KABI=$(echo zImage* | cut -d'-' -f2)
        cd -
        echo "Kernel ABI: "$KABI
        mkdir -p $SNAPCRAFT_PART_INSTALL/firmware/$KABI/device-tree
        cp -a $SNAPCRAFT_PART_INSTALL/dtbs/overlays/*.dtbo
$SNAPCRAFT_PART_INSTALL/firmware/$KABI/device-tree/
        rm -f $SNAPCRAFT_PART_INSTALL/dtbs/imx*.dtb
        rm -f $SNAPCRAFT_PART_INSTALL/dtbs/vf*.dtb
    build-packages:
      - lsb-release
      - bc
      - libssl-dev
      - rsync
      - lzop
  firmware:
    plugin: nil
    source: https://git.fo.com/foo.git
    install: |
      cp -a firmware $SNAPCRAFT_PART_INSTALL/
      ln -s /run/wlan/softmac.bin $SNAPCRAFT_PART_INSTALL/firmware/ath6k/AR6004/hw3.0/softmac.bin
      ln -s /run/wlan/ar3kbdaddr.pst $SNAPCRAFT_PART_INSTALL/firmware/ar3k/1020201/ar3kbdaddr.pst

[Adam Collard (adam-collard)]

2.34 is quite an old version of snapcraft, is this reproducible with snapcraft 2.40 (snap install snapcraft)?

Can you share either your snapcraft.yaml or your .snap?

[Samuele Pedroni (pedronis)]

afaik indeed snapcraft started passing all the relevant options to mksquashfs only since 2.38

[Samuele Pedroni (pedronis)]

it seems the squashfs might carry information about how it was built (flags used), so we could check them and also tell in the error that a too old snapcraft or something was used:

$ unsquashfs -s /var/lib/snapd/snaps/core_4443.snap
Found a valid SQUASHFS 4:0 superblock on /var/lib/snapd/snaps/core_4443.snap.
Creation or last append time Wed Apr 11 17:24:03 2018
Filesystem size 88629.63 Kbytes (86.55 Mbytes)
Compression xz
Block size 131072
Filesystem is exportable via NFS
Inodes are compressed
Data is compressed
Fragments are not stored
Xattrs are not stored
Duplicates are removed
Number of fragments 0
Number of inodes 12819
Number of ids 19

I didn't investigate properly but I think "Fragments are not stored" might relate to the required -no-fragments options.

[Evan (ev)]

Hey Adam. If old versions of snapcraft are not going to be accepted, can the store parse the snapcraft version out of the push request [1] and reply with a suitable error message? Something like:

Sorry, the version of snapcraft used to create this snap was too old. Please refresh your installation of snapcraft and re-create the snap.

1: https://github.com/snapcore/snapcraft/blob/40aec20bf672056c86f963a5aad4a2409e4c90b4/snapcraft/storeapi/_agent.py#L34

[Jamie Strandboge (jdstrand)]

Please upgrade to the latest snapcraft and rebuild (2.34 is too old). I can adjust the review-tools for the error.

[Konrad Zapałowicz (kzapalowicz)]

Updated the snapcraft to 2.40 and it works fine now. Thank you all for troubleshooting.

[Jamie Strandboge (jdstrand)]

FYI, I've just committed (r1024) a short-circuit test to detect if fragments are not used:

$ PYTHONPATH=./ ./bin/click-review ./tests/test-no-fragments_4.snap
Errors
------
 - security-snap-v2:squashfs_fragments
 The squashfs was built without '-no-fragments'. If using snapcraft, please upgrade to at least 2.38 and rebuild. Otherwise, please ensure the snap is built using 'mksquashfs <dir> <snap> -noappend -comp xz -all-root -no-xattrs -no-fragments'
./tests/test-no-fragments_4.snap: FAIL
[2]

and if the resquash fails for some other reason:
$ PYTHONPATH=./ ./bin/click-review ./tests/test-void-dir_0.1_all.snap
Errors
------
 - security-snap-v2:squashfs_repack_checksum
 checksums do not match. Please ensure the snap is created with either 'snapcraft pack <DIR>' (using snapcraft >= 2.38) or 'mksquashfs <dir> <snap> -noappend -comp xz -all-root -no-xattrs -no-fragments'
./tests/test-void-dir_0.1_all.snap: FAIL
[2]

[Jamie Strandboge (jdstrand)]

FYI, while the newer version of the review tools is finding its way to production, I've created the following forum topic: https://forum.snapcraft.io/t/automated-reviews-and-snapcraft-2-38/4982

[Olivier Tilloy (osomon)]

I'm getting those errors with automated builds of the chromium snap, which are performed by launchpad, and according to the logs it is using snapcraft 2.40 (see e.g. https://code.launchpad.net/~chromium-team/+snap/chromium-snap-stable/+build/193033).

[Jamie Strandboge (jdstrand)]

@Olivier, your issue is that chromium has a setuid chrome-sandbox. This can't resquash without fakeroot or similar. r1022 will allow chromium to pass automated review, but the store only has r1021.