Snap access issues using Brand Store

snapd
1

Not sure if the is the correct place for this post or not.

We have a brand store. We have devices built that authenticate with device store. They can install snaps, and show info on them.

Howerver, the can’t download snaps. The get:

error: cannot download snap "some-snap-name": snap not found

Also, I don’t know if this is related, but when I try and downlaod snaps from the device store or brand store directly I using variables UBUNTU_STORE_ID and UBUNTU_STORE_AUTH_DATA_FILENAME with a valid macaroon, I get:

error: cannot download snap "some-snap-name": snap not found

or

error: no snap found for "some-snap-name"

The account I use to generate the macaroon has viewer role, and the ACL for the macaroon is package_access

Cheers,
Just

2

My 2 cents told me this is the correct place :wink:

I would also assume that for some reason, the snap download sub-command doesn’t honor the brand store environment variables, in that case I suggest you file a bug against snapd.

3

Good call, I will double check the URL it tries.

But not being able to do a snap download from a device that is authenticated already, and can install a snap, seems weird :confused:

Cheers, Just

4

Could you clarify how you are trying to download the snaps e.g. snap install, snap refresh, snap download, or maybe even running ubuntu-image. The authentication requirements and what each of these do is slightly different.

There have been some service interruptions on the store in the last couple of days (https://status.snapcraft.io/), and this may have an impact. It’s possible that if the device tried to authenticate during one of the down times it may not have a session. A reboot should fix that.

It’s also worth checking that the device has received a serial assertion (snap known serial) as that is used for store authentication. It’s also worth a check to see that the snap is actually whitelisted for the specific store that is mentioned in the model assertion (snap known model).

If you are trying to use the macaroon, you need to have exported that before using it in the env var… but it sounds as though you knew that.

Since you have a brand store, you should be able to file a support case (or someone from your company can). Filing more details there will allow the store team to do more detailed investigation.

1 Like
5

Thanks @jamesj

There are two different things here. The device downloading the snap, and me downloading the snap.

When I try and download the snap I am doing this:

UBUNTU_STORE_ID=foo UBUNTU_STORE_AUTH_DATA_FILENAME=bar snap download  --channel current/stable some-snap-name

When I use the same auth file with ubuntu-image, and a signed model assertion, the snaps are downloaded fine.

Secondly, on the device. The device is able to install snaps fine, you can do a snap install some-snap-name, so it must be authenticated ok, but when you try and download a snap with snap download some-snap-name it fails with the above error.

Cheers,
Just

6

Thanks for the clarification.

I think the issue is with the UBUNTU_STORE_AUTH_DATA_FILENAME . I believe that that is only used by the ubuntu-image command and is ignored by the snap commands. I think you’ll need to do a snap login to use snap download, and you’ll also need the UBUNTU_STORE_ID (as you have done).

7

Note that snap download does not go through the snapd daemon and thus does not Leverage its authentication. This thread Snap access issues using Brand Store describes how to export credentials and use them with snap download.

1 Like
8

I think that this is the thread that @roadmr meant.

1 Like