please add mechanism to enforce trusted LP builds for snaps

[Jamie Strandboge]

In working through the processes surrounding 'confinement: classic' and who can use it, it has recently been agreed to by stakeholders (Jamie Bennett, Emily Ratliff and Bret Barker) that under certain conditions the store should enforce the use of LP builds. These reasons include:

- if using 'confinement: classic' and a member of motu/ubuntu-core-dev/canonical
- if using 'confinement: classic' with an official upstream open source project
- if the snap is designated as officially supported by Canonical

What this does is provide a direct path from the snap in the store to a particular source build.

All of the details have not been worked out yet for the above scenarios, however at a minimum the store can add a check (in the non-CRT checks) that can flag for human review if using 'confinement: classic' without a trusted LP build. In this manner, a human can waive something through if needed for each upload (ie, the decision isn't remembered to encourage people to move to trusted LP builds), but snap approvals flow normally for trusted LP builds.

[Colin Watson (cjwatson)]

Note that we need to sort out https://bugs.launchpad.net/launchpad-buildd/+bug/1650946 before "only LP builds for classic" constraints can usefully be imposed, although I certainly have no objection to the constraint in principle.

[Colin Watson (cjwatson)]

To save people chasing the link, for the record, there are no remaining blockers to this from the LP side as far as I'm aware, since the bug above was closed in mid-February.

[Jamie Strandboge (jdstrand)]

Adding a snapstore task. Please adjust it or the software-center-agent task as necessary.

[trespasserw (trespasserw)]

If I got it right, the constraint would be enforced only on certain "classic" apps and not on all of them. Correct? I just wonder if it would be possible to upload an image of a (partially) closed-source "classic" app into the store.

[Robie Basak (racb)]

Before enforcing this on some classic snaps, please fix https://forum.snapcraft.io/t/launchpad-post-build-pre-upload-testing/5545 first. For now I've taken Launchpad builds out of git-ubuntu's publication pipeline since we were hitting non-deterministic bad snap builds which, while detectable, cannot currently be blocked from publication by Launchpad since there currently exists no hook for Launchpad to be able to test produced snaps.