Could the installation docs mention that the Snap package for Hugo is official?

It’s fairly difficult for a security-conscious user to tell that the Snap Store version of Hugo is official. The installation docs seem to not mention the snap (except for a footnote on the Linux installation instructions stating “Snap packages are automatically updated”, which looks like it may be a mistake or a leftover from older documentation), the Snap isn’t mentioned in the Github readme, and the Hugo Authors account isn’t verified. The only documentation that strongly implies that sudo snap install hugo will give you an official binary and not some unofficial rebuild, is the function documentation for css.Sass, which mentions installing Hugo as a Snap package and links to the Snap Store page for Hugo. There’s also the release announcements here on Discourse, which mention and link to the Snap package, but the account used to post those links doesn’t have any distinguishing mark to tell a user “this person is part of the Hugo team” or similar.

There’s enough info for me to piece together that the Snap is official and therefore likely safe, but it would be nice if the installation docs linked to the Snap page. It would also work if the Hugo Authors account on Snapcraft was verified.

See:

We’ve been struggling with this for a few weeks, and have temporarily removed the Snap section from the Linux installation docs. The problem right now is that you can only install from the “edge” channel, which mostly[1] reflects the latest commit, not the latest release—and it skips release builds.

I could restore the documentation now, but once a user is on the “edge” channel, they will continue to be updated to the latest build unless they uninstall and reinstall using the “stable” channel after the issue above is restored.

I’m open to suggestions, but for now am inclined to leave the documentation as is.

And please note that the issue above is not on the back burner… it’s top of mind for myself and the project lead.


  1. Sometimes there are delays. ↩︎

1 Like