Verifying a snap's contents

If you set SNAPCRAFT_BUILD_INFO=1 when building a snap, it will dump the preprocessed snapcraft.yaml in snap/snapcraft.yaml. It will also create snap/manifest.yaml containing revision IDs of source control repos used in the build, and version numbers of build/stage packages.

This is currently opt-in as it potentially reveals details the snap author would prefer remain private. However it is enabled by default for builds done through Launchpad or build.snapcraft.io. This is the tech behind the security notices sent to snap authors for out of date packages:

2 Likes