Comment 3 for bug 1634803

Revision history for this message
Colin Watson (cjwatson) wrote :

This is intentional. Registering a key is a security-sensitive operation and requires independent authentication: the macaroon that grants authority to register a key must be fresh (generated in the last five minutes) and it must contain a specific permission that is not a subset of that granted by "snapcraft login". The credentials granted by "snapcraft login" are longer-lived and persist on disk, and we intentionally ensure that there are no persistent credentials that permit registering a new key that an attacker could use to upload snaps on behalf of the user.

I would simply amend the test case to delete the "snapcraft login" step here.

Sergio: That's incorrect. snapd does not require a macaroon here, as it does not communicate with the store.