You can finally disable Snap updates

Table of Contents

During the Ubuntu Summit, a long-awaited feature was quietly released for preview: You can now completely turn off automatic updates of snaps.

“The snap refresh --hold command holds, or postpones, snap updates for individual snaps, or for all snaps on the system, either indefinitely or for a specified period of time.”

(currently only available in edge channel of snapd)

This might sound like an obvious feature to many people, but it’s a continental shift in philosophy for the Snap developers.

Snaps allow users to easily install Linux applications. By default, snaps automatically update to the newest version. Snapd, the service that manages snaps, checks for updates four times in a day. Although there are many ways to control when and how often updates are installed, it was not possible to completely turn off automatic updates.

Wait, what?

Yes, this was a conscious choice by the developers. Outdated and insecure Linux system are a massive problem because they are weaponized into botnets that attack services and spread malware. In an attempt to help solve this issue, the Snap developers decided to simply make it impossible to turn off automatic updates. When Snap was initially released in 2014, automatic updates were so new to the Linux ecosystem that the developers feared every list of “10 things to do after installing <distro>” would include “turn off automatic updates”, making the issue of insecure Linux devices even larger.

Why now?

Nowadays, however, automatic updates have become commonplace. Even Ubuntu server has been automatically installing security updates since late 2016! Over the years, the snap update mechanism has been continuously refined to ensure updates don’t break things and to allow updates to happen at a convenient time. As a result, adding the functionality to disable updates will probably not result in a new wave of insecure devices. Moreover, as Snap matures and enters large enterprises with IT teams dedicated to manually updating software, adding this feature is a logical next step to give IT teams the control and predictability they have come to expect from Linux systems.

Tags :

Related Posts

How to verify the source of a Snap package

Many Snap packages contain two files which allow users to verify what sources were used to build the package. snap/snapcraft.yaml is the “source” of the package. This file was used by snapcraft to build the package. snap/manifest.yaml is a “recording” of the build of that package. It is similar to the first file, but it includes a lot more information to pinpoint what exact sources were being used. It records the exact package versions of dependencies, the git commit of all source repositories, checksums of any downloaded binary and more. The manifest is used by the Snap Store to check if Snap packages contain libraries with security vulnerabilities. If this is the case, the publisher gets an email asking them to rebuild the package.

Read More

Why is there only one Snap Store?

Snap and Flatpak are the basis of two universal app stores for Linux: the Snap Store and Flathub. Interestingly, Flatpak has multiple repositories: Flathub is the main one but both Fedora and Elementary OS also host their own store. In contrast; there is only one Snap store. Why is that?

Read More

Copyleft and LGPL in Snaps and Flatpaks

The question often comes up of how Snaps and Flatpaks influence copyleft, GPL and LGPL licenses. It is a common misconception that these new packaging formats significantly influence license compliance.

Read More