Can a Store validation-assertion be revoked?

store
1

Hi,

As per this discussion, I’m wondering if it’s possible to revoke a validation-assertion :

If it makes any difference, we have a Brand Store.

Is revocation possible ? Is it possible via standard user tools , or perhaps even the store API ? Or does it have to a Support Request ?

Cheers, Just

2

Sorry to revive an almost 2-year old thread, but the docs are still not clear on this.

Canonical Support mentioned something to me about a supposed --revoke argument but this doesn’t seem to be documented anywhere.

@jocado If you managed to figure this out on your own, it would be great if you could share it here. :slight_smile:

3

I don’t have a lot of info on the eventual solution, but is is possible.

I think we ended up using the snapcraft python library that is included in the snapcraft snap. It’s probably an oldish version now, but it has a storeapi class or some such.

If I remember rightly, you retrieve the assertion from the API, then submit it again with this in the :

revoked: true

Perhaps someone here can help more.

Cheers, Just

4

Closing the loop on this one: this is done by running the exact snapcraft validate command that was used to issue the validation assertion, but with an added --revoke flag.

For example:

# Issue a new validation assertion
$ snapcraft validate gating-snap gated-snap=123 --key-name key

# Revoke the validation assertion
$ snapcraft validate --revoke gating-snap gated-snap=123 --key-name key

Important note that’s insufficiently highlighted in the documentation in my opinion: in absence of a validation assertion, a gated snap will not refresh! You’re in this edge case if:

  1. You haven’t issued a validation assertion for gated-snap yet
  2. You have revoked all validation assertions for gated-snap

This bit me hard, because I was under the assumption that in the 2 cases above gated-snap would refresh to the latest available revision. I’m moving on to investigating if validation sets (a different type of assertion) are a better fit for my use-case: Validation sets

Sources:

2 Likes