[seenitall]

Evidence? I don’t think that’s the case. There are plenty of non-commercial snaps with system access, it’s really a question of the nature of the snap. You would want something like Puppet to be able to read and write files all over the system, so the snap declaration and metadata needs to say that. I think the only interaction with Canonical is that they need to review snaps which do have filesystem access to check that it makes sense and ty to spot Trojan horse apps being published that way. It’s not perfect but it’s sensible.