# With Fedora, nothing is bundled. For everything else, bundling is used. # To use bundled stuff, use "--with vendorized" on rpmbuild %if 0%{?fedora} %bcond_with vendorized %else %bcond_without vendorized %endif # A switch to allow building the package with support for testkeys which # are used for the spread test suite of snapd. %bcond_with testkeys %global with_devel 1 %global with_debug 1 %global with_check 0 %global with_unit_test 0 %global with_test_keys 0 # Set if multilib is enabled for supported arches %ifarch x86_64 aarch64 %{power64} s390x %global with_multilib 1 %endif # Set if valgrind is to be run %ifnarch ppc64le %global with_valgrind 1 %endif %if ! %{with vendorized} %global with_bundled 0 %else %global with_bundled 1 %endif %if ! %{with testkeys} %global with_test_keys 0 %else %global with_test_keys 1 %endif %if 0%{?with_debug} %global _dwz_low_mem_die_limit 0 %else %global debug_package %{nil} %endif %global provider github %global provider_tld com %global project snapcore %global repo snapd # https://github.com/snapcore/snapd %global provider_prefix %{provider}.%{provider_tld}/%{project}/%{repo} %global import_path %{provider_prefix} %global snappy_svcs snapd.service snapd.socket snapd.autoimport.service snapd.seeded.service snapd.mounts.target snapd.mounts-pre.target %global snappy_user_svcs snapd.session-agent.service snapd.session-agent.socket # Until we have a way to add more extldflags to gobuild macro... # Always use external linking when building static binaries. %if 0%{?fedora} || 0%{?rhel} >= 8 %define gobuild_static(o:) go build -buildmode pie -compiler gc -tags="rpm_crashtraceback ${BUILDTAGS:-}" -ldflags "-B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \\n') -linkmode external -extldflags '%__global_ldflags -static'" -a -v -x %{?**}; %endif %if 0%{?rhel} == 7 # no pass PIE flags due to https://bugzilla.redhat.com/show_bug.cgi?id=1634486 %define gobuild_static(o:) go build -compiler gc -tags="rpm_crashtraceback ${BUILDTAGS:-}" -ldflags "-B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \\n') -linkmode external -extldflags '%__global_ldflags -static'" -a -v -x %{?**}; %endif # These macros are missing BUILDTAGS in RHEL 8/9, see RHBZ#1825138 %if 0%{?rhel} >= 8 %define gobuild(o:) go build -buildmode pie -compiler gc -tags="rpm_crashtraceback ${BUILDTAGS:-}" -ldflags "-B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \\n') -linkmode external -extldflags '%__global_ldflags'" -a -v -x %{?**}; %endif # These macros are not defined in RHEL 7 %if 0%{?rhel} == 7 %define gobuild(o:) go build -compiler gc -tags="rpm_crashtraceback ${BUILDTAGS:-}" -ldflags "-B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \\n') -linkmode external -extldflags '%__global_ldflags'" -a -v -x %{?**}; %define gotest() go test -compiler gc %{?**}; %endif # Compat path macros %{!?_environmentdir: %global _environmentdir %{_prefix}/lib/environment.d} %{!?_systemdgeneratordir: %global _systemdgeneratordir %{_prefix}/lib/systemd/system-generators} %{!?_systemd_system_env_generator_dir: %global _systemd_system_env_generator_dir %{_prefix}/lib/systemd/system-environment-generators} %{!?_tmpfilesdir: %global _tmpfilesdir %{_prefix}/lib/tmpfiles.d} Name: snapd Version: 2.65.1 Release: 2%{?dist} Summary: A transactional software package manager License: GPL-3.0-only URL: https://%{provider_prefix} Source0: https://%{provider_prefix}/releases/download/%{version}/%{name}_%{version}.no-vendor.tar.xz Source1: https://%{provider_prefix}/releases/download/%{version}/%{name}_%{version}.only-vendor.tar.xz Patch0: 0001-data-selinux-remove-timedatex.patch ExclusiveArch: %{?golang_arches}%{!?golang_arches:%{ix86} x86_64 %{arm} aarch64 ppc64le s390x} # If go_compiler is not set to 1, there is no virtual provide. Use golang instead. BuildRequires: make BuildRequires: %{?go_compiler:compiler(go-compiler)}%{!?go_compiler:golang >= 1.9} BuildRequires: systemd %{?systemd_requires} Requires: snap-confine%{?_isa} = %{version}-%{release} Requires: squashfs-tools %if 0%{?rhel} && 0%{?rhel} < 8 # Rich dependencies not available, always pull in squashfuse # snapd will use squashfs.ko instead of squashfuse if it's on the system Requires: squashfuse Requires: fuse %else # snapd will use squashfuse in the event that squashfs.ko isn't available (cloud instances, containers, etc.) Requires: ((squashfuse and fuse) or kmod(squashfs.ko)) %endif # Require xdelta for delta updates of snap packages. %if 0%{?fedora} || ( 0%{?rhel} && 0%{?rhel} > 8 ) Requires: xdelta %endif # bash-completion owns /usr/share/bash-completion/completions Requires: bash-completion # Force the SELinux module to be installed Requires: %{name}-selinux = %{version}-%{release} %if 0%{?fedora} && 0%{?fedora} < 30 # snapd-login-service is no more # Note: Remove when F29 is EOL Obsoletes: %{name}-login-service < 1.33 Provides: %{name}-login-service = 1.33 Provides: %{name}-login-service%{?_isa} = 1.33 %endif %if ! 0%{?with_bundled} BuildRequires: golang(go.etcd.io/bbolt) BuildRequires: golang(github.com/bmatcuk/doublestar/v4) BuildRequires: golang(github.com/coreos/go-systemd/activation) BuildRequires: golang(github.com/godbus/dbus) BuildRequires: golang(github.com/godbus/dbus/introspect) BuildRequires: golang(github.com/gorilla/mux) BuildRequires: golang(github.com/jessevdk/go-flags) BuildRequires: golang(github.com/juju/ratelimit) BuildRequires: golang(github.com/kr/pretty) BuildRequires: golang(github.com/kr/text) BuildRequires: golang(github.com/mvo5/goconfigparser) BuildRequires: golang(github.com/seccomp/libseccomp-golang) BuildRequires: golang(github.com/snapcore/go-gettext) BuildRequires: golang(golang.org/x/crypto/openpgp/armor) BuildRequires: golang(golang.org/x/crypto/openpgp/packet) BuildRequires: golang(golang.org/x/crypto/sha3) BuildRequires: golang(golang.org/x/crypto/ssh/terminal) BuildRequires: golang(golang.org/x/xerrors) BuildRequires: golang(golang.org/x/xerrors/internal) BuildRequires: golang(gopkg.in/check.v1) BuildRequires: golang(gopkg.in/macaroon.v1) BuildRequires: golang(gopkg.in/mgo.v2/bson) BuildRequires: golang(gopkg.in/retry.v1) BuildRequires: golang(gopkg.in/tomb.v2) BuildRequires: golang(gopkg.in/yaml.v2) BuildRequires: golang(gopkg.in/yaml.v3) %endif %description Snappy is a modern, cross-distribution, transactional package manager designed for working with self-contained, immutable packages. %package -n snap-confine Summary: Confinement system for snap applications License: GPL-3.0-only BuildRequires: autoconf BuildRequires: autoconf-archive BuildRequires: automake BuildRequires: make BuildRequires: libtool BuildRequires: gcc BuildRequires: gettext BuildRequires: gnupg BuildRequires: pkgconfig(glib-2.0) BuildRequires: pkgconfig(libcap) BuildRequires: pkgconfig(libseccomp) BuildRequires: pkgconfig(libselinux) BuildRequires: pkgconfig(libudev) BuildRequires: pkgconfig(systemd) BuildRequires: pkgconfig(udev) BuildRequires: xfsprogs-devel BuildRequires: glibc-static %if ! 0%{?rhel} BuildRequires: libseccomp-static %endif %if 0%{?with_valgrind} BuildRequires: valgrind %endif BuildRequires: %{_bindir}/rst2man %if 0%{?fedora} # ShellCheck in EPEL is too old... BuildRequires: %{_bindir}/shellcheck %endif # Ensures older version from split packaging is replaced Obsoletes: snap-confine < 2.19 %description -n snap-confine This package is used internally by snapd to apply confinement to the started snap applications. %package selinux Summary: SELinux module for snapd License: GPL-2.0-or-later BuildArch: noarch BuildRequires: selinux-policy BuildRequires: selinux-policy-devel BuildRequires: make %{?selinux_requires} %description selinux This package provides the SELinux policy module to ensure snapd runs properly under an environment with SELinux enabled. %if 0%{?with_devel} %package devel Summary: Development files for %{name} BuildArch: noarch %if 0%{?with_check} && ! 0%{?with_bundled} %endif %if ! 0%{?with_bundled} Requires: golang(go.etcd.io/bbolt) Requires: golang(github.com/bmatcuk/doublestar/v4) Requires: golang(github.com/coreos/go-systemd/activation) Requires: golang(github.com/godbus/dbus) Requires: golang(github.com/godbus/dbus/introspect) Requires: golang(github.com/gorilla/mux) Requires: golang(github.com/jessevdk/go-flags) Requires: golang(github.com/juju/ratelimit) Requires: golang(github.com/kr/pretty) Requires: golang(github.com/kr/text) Requires: golang(github.com/mvo5/goconfigparser) Requires: golang(github.com/seccomp/libseccomp-golang) Requires: golang(github.com/snapcore/go-gettext) Requires: golang(golang.org/x/crypto/openpgp/armor) Requires: golang(golang.org/x/crypto/openpgp/packet) Requires: golang(golang.org/x/crypto/sha3) Requires: golang(golang.org/x/crypto/ssh/terminal) Requires: golang(golang.org/x/xerrors) Requires: golang(golang.org/x/xerrors/internal) Requires: golang(gopkg.in/check.v1) Requires: golang(gopkg.in/macaroon.v1) Requires: golang(gopkg.in/mgo.v2/bson) Requires: golang(gopkg.in/retry.v1) Requires: golang(gopkg.in/tomb.v2) Requires: golang(gopkg.in/yaml.v2) Requires: golang(gopkg.in/yaml.v3) %else # These Provides are unversioned because the sources in # the bundled tarball are unversioned (they go by git commit) # *sigh*... I hate golang... Provides: bundled(golang(go.etcd.io/bbolt)) Provides: bundled(golang(github.com/bmatcuk/doublestar/v4)) Provides: bundled(golang(github.com/coreos/go-systemd/activation)) Provides: bundled(golang(github.com/godbus/dbus)) Provides: bundled(golang(github.com/godbus/dbus/introspect)) Provides: bundled(golang(github.com/gorilla/mux)) Provides: bundled(golang(github.com/jessevdk/go-flags)) Provides: bundled(golang(github.com/juju/ratelimit)) Provides: bundled(golang(github.com/kr/pretty)) Provides: bundled(golang(github.com/kr/text)) Provides: bundled(golang(github.com/mvo5/goconfigparser)) Provides: bundled(golang(github.com/seccomp/libseccomp-golang)) Provides: bundled(golang(github.com/snapcore/go-gettext)) Provides: bundled(golang(golang.org/x/crypto/openpgp/armor)) Provides: bundled(golang(golang.org/x/crypto/openpgp/packet)) Provides: bundled(golang(golang.org/x/crypto/sha3)) Provides: bundled(golang(golang.org/x/crypto/ssh/terminal)) Provides: bundled(golang(golang.org/x/xerrors)) Provides: bundled(golang(golang.org/x/xerrors/internal)) Provides: bundled(golang(gopkg.in/check.v1)) Provides: bundled(golang(gopkg.in/macaroon.v1)) Provides: bundled(golang(gopkg.in/mgo.v2/bson)) Provides: bundled(golang(gopkg.in/retry.v1)) Provides: bundled(golang(gopkg.in/tomb.v2)) Provides: bundled(golang(gopkg.in/yaml.v2)) Provides: bundled(golang(gopkg.in/yaml.v3)) %endif # Generated by gofed Provides: golang(%{import_path}/advisor) = %{version}-%{release} Provides: golang(%{import_path}/arch) = %{version}-%{release} Provides: golang(%{import_path}/asserts) = %{version}-%{release} Provides: golang(%{import_path}/asserts/assertstest) = %{version}-%{release} Provides: golang(%{import_path}/asserts/internal) = %{version}-%{release} Provides: golang(%{import_path}/asserts/signtool) = %{version}-%{release} Provides: golang(%{import_path}/asserts/snapasserts) = %{version}-%{release} Provides: golang(%{import_path}/asserts/sysdb) = %{version}-%{release} Provides: golang(%{import_path}/asserts/systestkeys) = %{version}-%{release} Provides: golang(%{import_path}/boot) = %{version}-%{release} Provides: golang(%{import_path}/boot/boottest) = %{version}-%{release} Provides: golang(%{import_path}/bootloader) = %{version}-%{release} Provides: golang(%{import_path}/bootloader/androidbootenv) = %{version}-%{release} Provides: golang(%{import_path}/bootloader/assets) = %{version}-%{release} Provides: golang(%{import_path}/bootloader/assets/genasset) = %{version}-%{release} Provides: golang(%{import_path}/bootloader/bootloadertest) = %{version}-%{release} Provides: golang(%{import_path}/bootloader/efi) = %{version}-%{release} Provides: golang(%{import_path}/bootloader/grubenv) = %{version}-%{release} Provides: golang(%{import_path}/bootloader/lkenv) = %{version}-%{release} Provides: golang(%{import_path}/bootloader/ubootenv) = %{version}-%{release} Provides: golang(%{import_path}/client) = %{version}-%{release} Provides: golang(%{import_path}/client/clientutil) = %{version}-%{release} Provides: golang(%{import_path}/cmd/snap) = %{version}-%{release} Provides: golang(%{import_path}/cmd/snap-bootstrap) = %{version}-%{release} Provides: golang(%{import_path}/cmd/snap-bootstrap/triggerwatch) = %{version}-%{release} Provides: golang(%{import_path}/cmd/snap-exec) = %{version}-%{release} Provides: golang(%{import_path}/cmd/snap-failure) = %{version}-%{release} Provides: golang(%{import_path}/cmd/snap-preseed) = %{version}-%{release} Provides: golang(%{import_path}/cmd/snap-recovery-chooser) = %{version}-%{release} Provides: golang(%{import_path}/cmd/snap-repair) = %{version}-%{release} Provides: golang(%{import_path}/cmd/snap-seccomp) = %{version}-%{release} Provides: golang(%{import_path}/cmd/snap-seccomp/syscalls) = %{version}-%{release} Provides: golang(%{import_path}/cmd/snap-update-ns) = %{version}-%{release} Provides: golang(%{import_path}/cmd/snapctl) = %{version}-%{release} Provides: golang(%{import_path}/cmd/snapd) = %{version}-%{release} Provides: golang(%{import_path}/cmd/snaplock) = %{version}-%{release} Provides: golang(%{import_path}/cmd/snaplock/runinhibit) = %{version}-%{release} Provides: golang(%{import_path}/daemon) = %{version}-%{release} Provides: golang(%{import_path}/dbusutil) = %{version}-%{release} Provides: golang(%{import_path}/dbusutil/dbustest) = %{version}-%{release} Provides: golang(%{import_path}/desktop/notification) = %{version}-%{release} Provides: golang(%{import_path}/desktop/notification/notificationtest) = %{version}-%{release} Provides: golang(%{import_path}/dirs) = %{version}-%{release} Provides: golang(%{import_path}/docs) = %{version}-%{release} Provides: golang(%{import_path}/features) = %{version}-%{release} Provides: golang(%{import_path}/gadget) = %{version}-%{release} Provides: golang(%{import_path}/gadget/edition) = %{version}-%{release} Provides: golang(%{import_path}/gadget/install) = %{version}-%{release} Provides: golang(%{import_path}/gadget/internal) = %{version}-%{release} Provides: golang(%{import_path}/gadget/quantity) = %{version}-%{release} Provides: golang(%{import_path}/httputil) = %{version}-%{release} Provides: golang(%{import_path}/i18n) = %{version}-%{release} Provides: golang(%{import_path}/i18n/xgettext-go) = %{version}-%{release} Provides: golang(%{import_path}/image) = %{version}-%{release} Provides: golang(%{import_path}/interfaces) = %{version}-%{release} Provides: golang(%{import_path}/interfaces/apparmor) = %{version}-%{release} Provides: golang(%{import_path}/interfaces/backends) = %{version}-%{release} Provides: golang(%{import_path}/interfaces/builtin) = %{version}-%{release} Provides: golang(%{import_path}/interfaces/dbus) = %{version}-%{release} Provides: golang(%{import_path}/interfaces/hotplug) = %{version}-%{release} Provides: golang(%{import_path}/interfaces/ifacetest) = %{version}-%{release} Provides: golang(%{import_path}/interfaces/kmod) = %{version}-%{release} Provides: golang(%{import_path}/interfaces/mount) = %{version}-%{release} Provides: golang(%{import_path}/interfaces/policy) = %{version}-%{release} Provides: golang(%{import_path}/interfaces/seccomp) = %{version}-%{release} Provides: golang(%{import_path}/interfaces/systemd) = %{version}-%{release} Provides: golang(%{import_path}/interfaces/udev) = %{version}-%{release} Provides: golang(%{import_path}/interfaces/utils) = %{version}-%{release} Provides: golang(%{import_path}/jsonutil) = %{version}-%{release} Provides: golang(%{import_path}/jsonutil/safejson) = %{version}-%{release} Provides: golang(%{import_path}/kernel) = %{version}-%{release} Provides: golang(%{import_path}/logger) = %{version}-%{release} Provides: golang(%{import_path}/metautil) = %{version}-%{release} Provides: golang(%{import_path}/netutil) = %{version}-%{release} Provides: golang(%{import_path}/osutil) = %{version}-%{release} Provides: golang(%{import_path}/osutil/disks) = %{version}-%{release} Provides: golang(%{import_path}/osutil/mount) = %{version}-%{release} Provides: golang(%{import_path}/osutil/squashfs) = %{version}-%{release} Provides: golang(%{import_path}/osutil/strace) = %{version}-%{release} Provides: golang(%{import_path}/osutil/sys) = %{version}-%{release} Provides: golang(%{import_path}/osutil/udev/crawler) = %{version}-%{release} Provides: golang(%{import_path}/osutil/udev/netlink) = %{version}-%{release} Provides: golang(%{import_path}/overlord) = %{version}-%{release} Provides: golang(%{import_path}/overlord/assertstate) = %{version}-%{release} Provides: golang(%{import_path}/overlord/assertstate/assertstatetest) = %{version}-%{release} Provides: golang(%{import_path}/overlord/auth) = %{version}-%{release} Provides: golang(%{import_path}/overlord/cmdstate) = %{version}-%{release} Provides: golang(%{import_path}/overlord/configstate) = %{version}-%{release} Provides: golang(%{import_path}/overlord/configstate/config) = %{version}-%{release} Provides: golang(%{import_path}/overlord/configstate/configcore) = %{version}-%{release} Provides: golang(%{import_path}/overlord/configstate/proxyconf) = %{version}-%{release} Provides: golang(%{import_path}/overlord/configstate/settings) = %{version}-%{release} Provides: golang(%{import_path}/overlord/devicestate) = %{version}-%{release} Provides: golang(%{import_path}/overlord/devicestate/devicestatetest) = %{version}-%{release} Provides: golang(%{import_path}/overlord/devicestate/fde) = %{version}-%{release} Provides: golang(%{import_path}/overlord/devicestate/internal) = %{version}-%{release} Provides: golang(%{import_path}/overlord/healthstate) = %{version}-%{release} Provides: golang(%{import_path}/overlord/hookstate) = %{version}-%{release} Provides: golang(%{import_path}/overlord/hookstate/ctlcmd) = %{version}-%{release} Provides: golang(%{import_path}/overlord/hookstate/hooktest) = %{version}-%{release} Provides: golang(%{import_path}/overlord/ifacestate) = %{version}-%{release} Provides: golang(%{import_path}/overlord/ifacestate/ifacerepo) = %{version}-%{release} Provides: golang(%{import_path}/overlord/ifacestate/udevmonitor) = %{version}-%{release} Provides: golang(%{import_path}/overlord/patch) = %{version}-%{release} Provides: golang(%{import_path}/overlord/servicestate) = %{version}-%{release} Provides: golang(%{import_path}/overlord/snapshotstate) = %{version}-%{release} Provides: golang(%{import_path}/overlord/snapshotstate/backend) = %{version}-%{release} Provides: golang(%{import_path}/overlord/snapstate) = %{version}-%{release} Provides: golang(%{import_path}/overlord/snapstate/backend) = %{version}-%{release} Provides: golang(%{import_path}/overlord/snapstate/policy) = %{version}-%{release} Provides: golang(%{import_path}/overlord/snapstate/snapstatetest) = %{version}-%{release} Provides: golang(%{import_path}/overlord/standby) = %{version}-%{release} Provides: golang(%{import_path}/overlord/state) = %{version}-%{release} Provides: golang(%{import_path}/overlord/storecontext) = %{version}-%{release} Provides: golang(%{import_path}/polkit) = %{version}-%{release} Provides: golang(%{import_path}/progress) = %{version}-%{release} Provides: golang(%{import_path}/progress/progresstest) = %{version}-%{release} Provides: golang(%{import_path}/randutil) = %{version}-%{release} Provides: golang(%{import_path}/release) = %{version}-%{release} Provides: golang(%{import_path}/sandbox) = %{version}-%{release} Provides: golang(%{import_path}/sandbox/apparmor) = %{version}-%{release} Provides: golang(%{import_path}/sandbox/cgroup) = %{version}-%{release} Provides: golang(%{import_path}/sandbox/seccomp) = %{version}-%{release} Provides: golang(%{import_path}/sandbox/selinux) = %{version}-%{release} Provides: golang(%{import_path}/sanity) = %{version}-%{release} Provides: golang(%{import_path}/secboot) = %{version}-%{release} Provides: golang(%{import_path}/seed) = %{version}-%{release} Provides: golang(%{import_path}/seed/internal) = %{version}-%{release} Provides: golang(%{import_path}/seed/seedtest) = %{version}-%{release} Provides: golang(%{import_path}/seed/seedwriter) = %{version}-%{release} Provides: golang(%{import_path}/snap) = %{version}-%{release} Provides: golang(%{import_path}/snap/channel) = %{version}-%{release} Provides: golang(%{import_path}/snap/internal) = %{version}-%{release} Provides: golang(%{import_path}/snap/naming) = %{version}-%{release} Provides: golang(%{import_path}/snap/pack) = %{version}-%{release} Provides: golang(%{import_path}/snap/snapdir) = %{version}-%{release} Provides: golang(%{import_path}/snap/snapenv) = %{version}-%{release} Provides: golang(%{import_path}/snap/snapfile) = %{version}-%{release} Provides: golang(%{import_path}/snap/snaptest) = %{version}-%{release} Provides: golang(%{import_path}/snap/squashfs) = %{version}-%{release} Provides: golang(%{import_path}/snapdenv) = %{version}-%{release} Provides: golang(%{import_path}/snapdtool) = %{version}-%{release} Provides: golang(%{import_path}/spdx) = %{version}-%{release} Provides: golang(%{import_path}/store) = %{version}-%{release} Provides: golang(%{import_path}/store/storetest) = %{version}-%{release} Provides: golang(%{import_path}/strutil) = %{version}-%{release} Provides: golang(%{import_path}/strutil/chrorder) = %{version}-%{release} Provides: golang(%{import_path}/strutil/quantity) = %{version}-%{release} Provides: golang(%{import_path}/strutil/shlex) = %{version}-%{release} Provides: golang(%{import_path}/sysconfig) = %{version}-%{release} Provides: golang(%{import_path}/systemd) = %{version}-%{release} Provides: golang(%{import_path}/testutil) = %{version}-%{release} Provides: golang(%{import_path}/timeout) = %{version}-%{release} Provides: golang(%{import_path}/timeutil) = %{version}-%{release} Provides: golang(%{import_path}/timings) = %{version}-%{release} Provides: golang(%{import_path}/usersession/agent) = %{version}-%{release} Provides: golang(%{import_path}/usersession/autostart) = %{version}-%{release} Provides: golang(%{import_path}/usersession/client) = %{version}-%{release} Provides: golang(%{import_path}/usersession/userd) = %{version}-%{release} Provides: golang(%{import_path}/usersession/userd/ui) = %{version}-%{release} Provides: golang(%{import_path}/usersession/xdgopenproxy) = %{version}-%{release} Provides: golang(%{import_path}/wrappers) = %{version}-%{release} Provides: golang(%{import_path}/x11) = %{version}-%{release} %description devel This package contains library source intended for building other packages which use import path with %{import_path} prefix. %endif %if 0%{?with_unit_test} && 0%{?with_devel} %package unit-test-devel Summary: Unit tests for %{name} package %if 0%{?with_check} #Here comes all BuildRequires: PACKAGE the unit tests #in %%check section need for running %endif # test subpackage tests code from devel subpackage Requires: %{name}-devel = %{version}-%{release} %description unit-test-devel This package contains unit tests for project providing packages with %{import_path} prefix. %endif %prep %if ! 0%{?with_bundled} %setup -q # Ensure there's no bundled stuff accidentally leaking in... rm -rf vendor/* %else # Extract each tarball properly %setup -q -D -b 1 %endif # Apply patches %autopatch -p1 %build # Build snapd mkdir -p src/github.com/snapcore ln -s ../../../ src/github.com/snapcore/snapd export GOPATH=$(pwd):%{gopath} # FIXME: move spec file really to a go.mod world instead of this hack rm -f go.mod export GO111MODULE=off # Generate version files ./mkversion.sh "%{version}-%{release}" # see https://github.com/gofed/go-macros/blob/master/rpm/macros.d/macros.go-compilers-golang BUILDTAGS= %if 0%{?with_test_keys} BUILDTAGS="withtestkeys nosecboot" %else BUILDTAGS="nosecboot" %endif %if ! 0%{?with_bundled} # We don't need the snapcore fork for bolt - it is just a fix on ppc sed -e "s:github.com/snapcore/bolt:github.com/boltdb/bolt:g" -i advisor/*.go %endif # We have to build snapd first to prevent the build from # building various things from the tree without additional # set tags. %gobuild -o bin/snapd $GOFLAGS %{import_path}/cmd/snapd BUILDTAGS="${BUILDTAGS} nomanagers" %gobuild -o bin/snap $GOFLAGS %{import_path}/cmd/snap %gobuild -o bin/snap-failure $GOFLAGS %{import_path}/cmd/snap-failure # To ensure things work correctly with base snaps, # snap-exec, snap-update-ns, and snapctl need to be built statically ( %if 0%{?rhel} >= 7 # since RH Developer tools 2018.4 (and later releases), # the go-toolset module is built with FIPS compliance that # defaults to using libcrypto.so which gets loaded at runtime via dlopen(), # disable that functionality for statically built binaries BUILDTAGS="${BUILDTAGS} no_openssl" %endif %gobuild_static -o bin/snap-exec $GOFLAGS %{import_path}/cmd/snap-exec %gobuild_static -o bin/snap-update-ns $GOFLAGS %{import_path}/cmd/snap-update-ns %gobuild_static -o bin/snapctl $GOFLAGS %{import_path}/cmd/snapctl ) %gobuild -o bin/snap-seccomp $GOFLAGS %{import_path}/cmd/snap-seccomp ( %if 0%{?rhel} == 7 M4PARAM='-D distro_rhel7' %endif %if 0%{?rhel} == 7 || 0%{?rhel} == 8 || 0%{?rhel} == 9 # RHEL7, RHEL8 and RHEL9 are missing the BPF interfaces from their reference policy M4PARAM="$M4PARAM -D no_bpf" %endif # Build SELinux module cd ./data/selinux # pass M4PARAM in env instead of as an override, so that make can still # manipulate it freely, for more details see: # https://www.gnu.org/software/make/manual/html_node/Override-Directive.html M4PARAM="$M4PARAM" make SHARE="%{_datadir}" TARGETS="snappy" ) # Build snap-confine pushd ./cmd autoreconf --force --install --verbose # FIXME: add --enable-caps-over-setuid as soon as possible (setuid discouraged!) %configure \ --disable-apparmor \ --enable-selinux \ %if 0%{?rhel} == 7 --disable-bpf \ %endif --libexecdir=%{_libexecdir}/snapd/ \ --enable-nvidia-biarch \ %{?with_multilib:--with-32bit-libdir=%{_prefix}/lib} \ --with-snap-mount-dir=%{_sharedstatedir}/snapd/snap \ --enable-merged-usr %make_build %{!?with_valgrind:HAVE_VALGRIND=} popd # Build systemd units, dbus services, and env files pushd ./data make BINDIR="%{_bindir}" LIBEXECDIR="%{_libexecdir}" DATADIR="%{_datadir}" \ SYSTEMDSYSTEMUNITDIR="%{_unitdir}" \ SNAP_MOUNT_DIR="%{_sharedstatedir}/snapd/snap" \ SNAPD_ENVIRONMENT_FILE="%{_sysconfdir}/sysconfig/snapd" popd %install install -d -p %{buildroot}%{_bindir} install -d -p %{buildroot}%{_libexecdir}/snapd install -d -p %{buildroot}%{_mandir}/man8 install -d -p %{buildroot}%{_environmentdir} install -d -p %{buildroot}%{_systemdgeneratordir} install -d -p %{buildroot}%{_systemd_system_env_generator_dir} install -d -p %{buildroot}%{_tmpfilesdir} install -d -p %{buildroot}%{_unitdir} install -d -p %{buildroot}%{_userunitdir} install -d -p %{buildroot}%{_sysconfdir}/profile.d install -d -p %{buildroot}%{_sysconfdir}/sysconfig install -d -p %{buildroot}%{_sharedstatedir}/snapd/assertions install -d -p %{buildroot}%{_sharedstatedir}/snapd/cookie install -d -p %{buildroot}%{_sharedstatedir}/snapd/cgroup install -d -p %{buildroot}%{_sharedstatedir}/snapd/dbus-1/services install -d -p %{buildroot}%{_sharedstatedir}/snapd/dbus-1/system-services install -d -p %{buildroot}%{_sharedstatedir}/snapd/desktop/applications install -d -p %{buildroot}%{_sharedstatedir}/snapd/device install -d -p %{buildroot}%{_sharedstatedir}/snapd/environment install -d -p %{buildroot}%{_sharedstatedir}/snapd/hostfs install -d -p %{buildroot}%{_sharedstatedir}/snapd/inhibit install -d -p %{buildroot}%{_sharedstatedir}/snapd/lib/gl install -d -p %{buildroot}%{_sharedstatedir}/snapd/lib/gl32 install -d -p %{buildroot}%{_sharedstatedir}/snapd/lib/glvnd install -d -p %{buildroot}%{_sharedstatedir}/snapd/lib/vulkan install -d -p %{buildroot}%{_sharedstatedir}/snapd/mount install -d -p %{buildroot}%{_sharedstatedir}/snapd/seccomp/bpf install -d -p %{buildroot}%{_sharedstatedir}/snapd/snaps install -d -p %{buildroot}%{_sharedstatedir}/snapd/snap/bin install -d -p %{buildroot}%{_localstatedir}/snap install -d -p %{buildroot}%{_localstatedir}/cache/snapd install -d -p %{buildroot}%{_datadir}/polkit-1/actions install -d -p %{buildroot}%{_datadir}/selinux/devel/include/contrib install -d -p %{buildroot}%{_datadir}/selinux/packages # Install snap and snapd install -p -m 0755 bin/snap %{buildroot}%{_bindir} install -p -m 0755 bin/snap-exec %{buildroot}%{_libexecdir}/snapd install -p -m 0755 bin/snap-failure %{buildroot}%{_libexecdir}/snapd install -p -m 0755 bin/snapd %{buildroot}%{_libexecdir}/snapd install -p -m 0755 bin/snap-update-ns %{buildroot}%{_libexecdir}/snapd install -p -m 0755 bin/snap-seccomp %{buildroot}%{_libexecdir}/snapd # Ensure /usr/bin/snapctl is a symlink to /usr/libexec/snapd/snapctl install -p -m 0755 bin/snapctl %{buildroot}%{_libexecdir}/snapd/snapctl ln -sf %{_libexecdir}/snapd/snapctl %{buildroot}%{_bindir}/snapctl # Install SELinux module install -p -m 0644 data/selinux/snappy.if %{buildroot}%{_datadir}/selinux/devel/include/contrib install -p -m 0644 data/selinux/snappy.pp.bz2 %{buildroot}%{_datadir}/selinux/packages # Install snap(8) man page bin/snap help --man > %{buildroot}%{_mandir}/man8/snap.8 # Install the "info" data file with snapd version install -m 644 -D data/info %{buildroot}%{_libexecdir}/snapd/info # Install bash completion for "snap" install -m 644 -D data/completion/bash/snap %{buildroot}%{_datadir}/bash-completion/completions/snap install -m 644 -D data/completion/bash/complete.sh %{buildroot}%{_libexecdir}/snapd install -m 644 -D data/completion/bash/etelpmoc.sh %{buildroot}%{_libexecdir}/snapd # Install zsh completion for "snap" install -d -p %{buildroot}%{_datadir}/zsh/site-functions install -m 644 -D data/completion/zsh/_snap %{buildroot}%{_datadir}/zsh/site-functions/_snap # Install snap-confine pushd ./cmd %make_install # Undo the 0111 permissions, they are restored in the files section chmod 0755 %{buildroot}%{_sharedstatedir}/snapd/void # We don't use AppArmor rm -rfv %{buildroot}%{_sysconfdir}/apparmor.d popd # Install all systemd and dbus units, and env files pushd ./data %make_install BINDIR="%{_bindir}" LIBEXECDIR="%{_libexecdir}" DATADIR="%{_datadir}" \ SYSTEMDSYSTEMUNITDIR="%{_unitdir}" SYSTEMDUSERUNITDIR="%{_userunitdir}" \ TMPFILESDIR="%{_tmpfilesdir}" \ SNAP_MOUNT_DIR="%{_sharedstatedir}/snapd/snap" \ SNAPD_ENVIRONMENT_FILE="%{_sysconfdir}/sysconfig/snapd" popd %if 0%{?rhel} == 7 # Install kernel tweaks # See: https://access.redhat.com/articles/3128691 install -m 644 -D data/sysctl/rhel7-snap.conf %{buildroot}%{_sysctldir}/99-snap.conf %endif # Remove snappy core specific units rm -fv %{buildroot}%{_unitdir}/snapd.system-shutdown.service rm -fv %{buildroot}%{_unitdir}/snapd.snap-repair.* rm -fv %{buildroot}%{_unitdir}/snapd.core-fixup.* rm -fv %{buildroot}%{_unitdir}/snapd.recovery-chooser-trigger.service # Remove snappy core specific scripts and binaries rm %{buildroot}%{_libexecdir}/snapd/snapd.core-fixup.sh rm %{buildroot}%{_libexecdir}/snapd/system-shutdown # Remove snapd apparmor service rm -f %{buildroot}%{_unitdir}/snapd.apparmor.service rm -f %{buildroot}%{_libexecdir}/snapd/snapd-apparmor # Disable re-exec by default echo 'SNAP_REEXEC=0' > %{buildroot}%{_sysconfdir}/sysconfig/snapd # Create state.json and the README file to be ghosted touch %{buildroot}%{_sharedstatedir}/snapd/state.json touch %{buildroot}%{_sharedstatedir}/snapd/snap/README # source codes for building projects %if 0%{?with_devel} install -d -p %{buildroot}/%{gopath}/src/%{import_path}/ echo "%%dir %%{gopath}/src/%%{import_path}/." >> devel.file-list # find all *.go but no *_test.go files and generate devel.file-list for file in $(find . -iname "*.go" -o -iname "*.s" \! -iname "*_test.go") ; do echo "%%dir %%{gopath}/src/%%{import_path}/$(dirname $file)" >> devel.file-list install -d -p %{buildroot}/%{gopath}/src/%{import_path}/$(dirname $file) cp -pav $file %{buildroot}/%{gopath}/src/%{import_path}/$file echo "%%{gopath}/src/%%{import_path}/$file" >> devel.file-list done %endif # testing files for this project %if 0%{?with_unit_test} && 0%{?with_devel} install -d -p %{buildroot}/%{gopath}/src/%{import_path}/ # find all *_test.go files and generate unit-test.file-list for file in $(find . -iname "*_test.go"); do echo "%%dir %%{gopath}/src/%%{import_path}/$(dirname $file)" >> devel.file-list install -d -p %{buildroot}/%{gopath}/src/%{import_path}/$(dirname $file) cp -pav $file %{buildroot}/%{gopath}/src/%{import_path}/$file echo "%%{gopath}/src/%%{import_path}/$file" >> unit-test-devel.file-list done # Install additional testdata install -d %{buildroot}/%{gopath}/src/%{import_path}/cmd/snap/test-data/ cp -pav cmd/snap/test-data/* %{buildroot}/%{gopath}/src/%{import_path}/cmd/snap/test-data/ echo "%%{gopath}/src/%%{import_path}/cmd/snap/test-data" >> unit-test-devel.file-list %endif %if 0%{?with_devel} sort -u -o devel.file-list devel.file-list %endif %check for binary in snap-exec snap-update-ns snapctl; do ldd bin/$binary 2>&1 | grep 'not a dynamic executable' done # snapd tests %if 0%{?with_check} && 0%{?with_unit_test} && 0%{?with_devel} %if ! 0%{?with_bundled} export GOPATH=%{buildroot}/%{gopath}:%{gopath} %else export GOPATH=%{buildroot}/%{gopath}:$(pwd)/Godeps/_workspace:%{gopath} %endif # FIXME: we are in the go.mod world now but without this things fall apart export GO111MODULE=off %gotest %{import_path}/... %endif # snap-confine tests (these always run!) pushd ./cmd make check popd %files #define license tag if not already defined %{!?_licensedir:%global license %doc} %license COPYING %doc README.md docs/* %{_bindir}/snap %{_bindir}/snapctl %{_environmentdir}/990-snapd.conf %if 0%{?rhel} == 7 %{_sysctldir}/99-snap.conf %endif %dir %{_libexecdir}/snapd %{_libexecdir}/snapd/snapctl %{_libexecdir}/snapd/snapd %{_libexecdir}/snapd/snap-exec %{_libexecdir}/snapd/snap-failure %{_libexecdir}/snapd/info %{_libexecdir}/snapd/snap-mgmt %{_libexecdir}/snapd/snap-mgmt-selinux %{_mandir}/man8/snap.8* %{_datadir}/applications/snap-handle-link.desktop %{_datadir}/bash-completion/completions/snap %{_libexecdir}/snapd/complete.sh %{_libexecdir}/snapd/etelpmoc.sh %{_datadir}/zsh/site-functions/_snap %{_libexecdir}/snapd/snapd.run-from-snap %{_sysconfdir}/profile.d/snapd.sh %{_mandir}/man8/snapd-env-generator.8* %{_systemd_system_env_generator_dir}/snapd-env-generator %{_unitdir}/snapd.socket %{_unitdir}/snapd.service %{_unitdir}/snapd.autoimport.service %{_unitdir}/snapd.failure.service %{_unitdir}/snapd.seeded.service %{_unitdir}/snapd.mounts.target %{_unitdir}/snapd.mounts-pre.target %{_userunitdir}/snapd.session-agent.service %{_userunitdir}/snapd.session-agent.socket %{_tmpfilesdir}/snapd.conf %{_datadir}/dbus-1/services/io.snapcraft.Launcher.service %{_datadir}/dbus-1/services/io.snapcraft.SessionAgent.service %{_datadir}/dbus-1/services/io.snapcraft.Settings.service %{_datadir}/dbus-1/session.d/snapd.session-services.conf %{_datadir}/dbus-1/system.d/snapd.system-services.conf %{_datadir}/polkit-1/actions/io.snapcraft.snapd.policy %{_datadir}/applications/io.snapcraft.SessionAgent.desktop %{_datadir}/fish/vendor_conf.d/snapd.fish %{_datadir}/snapd/snapcraft-logo-bird.svg %{_sysconfdir}/xdg/autostart/snap-userd-autostart.desktop %config(noreplace) %{_sysconfdir}/sysconfig/snapd %dir %{_sharedstatedir}/snapd %dir %{_sharedstatedir}/snapd/assertions %dir %{_sharedstatedir}/snapd/cookie %dir %{_sharedstatedir}/snapd/cgroup %dir %{_sharedstatedir}/snapd/dbus-1 %dir %{_sharedstatedir}/snapd/dbus-1/services %dir %{_sharedstatedir}/snapd/dbus-1/system-services %dir %{_sharedstatedir}/snapd/desktop %dir %{_sharedstatedir}/snapd/desktop/applications %dir %{_sharedstatedir}/snapd/device %dir %{_sharedstatedir}/snapd/hostfs %dir %{_sharedstatedir}/snapd/inhibit %dir %{_sharedstatedir}/snapd/lib %dir %{_sharedstatedir}/snapd/lib/gl %dir %{_sharedstatedir}/snapd/lib/gl32 %dir %{_sharedstatedir}/snapd/lib/glvnd %dir %{_sharedstatedir}/snapd/lib/vulkan %dir %{_sharedstatedir}/snapd/mount %dir %{_sharedstatedir}/snapd/seccomp %dir %{_sharedstatedir}/snapd/seccomp/bpf %dir %{_sharedstatedir}/snapd/snaps %dir %{_sharedstatedir}/snapd/snap %ghost %dir %{_sharedstatedir}/snapd/snap/bin %dir %{_localstatedir}/cache/snapd %dir %{_localstatedir}/snap %ghost %{_sharedstatedir}/snapd/state.json %ghost %{_sharedstatedir}/snapd/snap/README # this is typically owned by zsh, but we do not want to explicitly require zsh %dir %{_datadir}/zsh %dir %{_datadir}/zsh/site-functions # similar case for fish %dir %{_datadir}/fish/vendor_conf.d %files -n snap-confine %doc cmd/snap-confine/PORTING %license COPYING %dir %{_libexecdir}/snapd # For now, we can't use caps # FIXME: Switch to "%%attr(0755,root,root) %%caps(cap_sys_admin=pe)" asap! %attr(4755,root,root) %{_libexecdir}/snapd/snap-confine %{_libexecdir}/snapd/snap-device-helper %{_libexecdir}/snapd/snap-discard-ns %{_libexecdir}/snapd/snap-gdb-shim %{_libexecdir}/snapd/snap-gdbserver-shim %{_libexecdir}/snapd/snap-seccomp %{_libexecdir}/snapd/snap-update-ns %{_mandir}/man8/snap-confine.8* %{_mandir}/man8/snap-discard-ns.8* %{_systemdgeneratordir}/snapd-generator %attr(0111,root,root) %{_sharedstatedir}/snapd/void %files selinux %license data/selinux/COPYING %doc data/selinux/README.md %{_datadir}/selinux/packages/snappy.pp.bz2 %{_datadir}/selinux/devel/include/contrib/snappy.if %if 0%{?with_devel} %files devel -f devel.file-list %license COPYING %doc README.md %dir %{gopath}/src/%{provider}.%{provider_tld}/%{project} %endif %if 0%{?with_unit_test} && 0%{?with_devel} %files unit-test-devel -f unit-test-devel.file-list %license COPYING %doc README.md %endif %post %if 0%{?rhel} == 7 %sysctl_apply 99-snap.conf %endif %systemd_post %{snappy_svcs} %systemd_user_post %{snappy_user_svcs} # If install, test if snapd socket and timer are enabled. # If enabled, then attempt to start them. This will silently fail # in chroots or other environments where services aren't expected # to be started. if [ $1 -eq 1 ] ; then if systemctl -q is-enabled snapd.socket > /dev/null 2>&1 ; then systemctl start snapd.socket > /dev/null 2>&1 || : fi fi %preun %systemd_preun %{snappy_svcs} %systemd_user_preun %{snappy_user_svcs} # Remove all Snappy content if snapd is being fully uninstalled if [ $1 -eq 0 ]; then %{_libexecdir}/snapd/snap-mgmt --purge || : fi %postun %systemd_postun_with_restart %{snappy_svcs} %systemd_user_postun_with_restart %{snappy_user_svcs} %triggerun -- snapd < 2.39 # TODO: the trigger relies on a very specific snapd version that introduced SELinux # mount context, figure out how to update the trigger condition to run when needed # Trigger on uninstall, with one version of the package being pre 2.38 see # https://rpm-packaging-guide.github.io/#triggers-and-scriptlets for details # when triggers are run if [ "$1" -eq 2 -a "$2" -eq 1 ]; then # Upgrade from pre 2.38 version %{_libexecdir}/snapd/snap-mgmt-selinux --patch-selinux-mount-context=system_u:object_r:snappy_snap_t:s0 || : # snapd might have created fontconfig cache directory earlier, but with # incorrect context due to bugs in the policy, make sure it gets the right one # on upgrade when the new policy was introduced if [ -d "%{_localstatedir}/cache/fontconfig" ]; then restorecon -R %{_localstatedir}/cache/fontconfig || : fi elif [ "$1" -eq 1 -a "$2" -eq 2 ]; then # Downgrade to a pre 2.38 version %{_libexecdir}/snapd/snap-mgmt-selinux --remove-selinux-mount-context=system_u:object_r:snappy_snap_t:s0 || : fi %pre selinux %selinux_relabel_pre %post selinux %selinux_modules_install %{_datadir}/selinux/packages/snappy.pp.bz2 %selinux_relabel_post %posttrans selinux %selinux_relabel_post %postun selinux %selinux_modules_uninstall snappy if [ $1 -eq 0 ]; then %selinux_relabel_post fi %changelog * Fri Oct 25 2024 Zygmunt Krynicki - Cherry pick fix for SELinux timedatex problem from upstream * Sat Aug 24 2024 Ernest Lotter - New upstream release 2.65.1 - Support building snapd using base Core22 (Snapcraft 8.x) - FIPS: support building FIPS complaint snapd variant that switches to FIPS mode when the system boots with FIPS enabled - AppArmor: update to latest 4.0.2 release - AppArmor: enable using ABI 4.0 from host parser - AppArmor: fix parser lookup - AppArmor: support AppArmor snippet priorities - AppArmor: allow reading cgroup memory.max file - AppArmor: allow using snap-exec coming from the snapd snap when starting a confined process with jailmode - AppArmor prompting (experimental): add checks for prompting support, include prompting status in system key, and restart snapd if prompting flag changes - AppArmor prompting (experimental): include prompt prefix in AppArmor rules if prompting is supported and enabled - AppArmor prompting (experimental): add common types, constraints, and mappings from AppArmor permissions to abstract permissions - AppArmor prompting (experimental): add path pattern parsing and matching - AppArmor prompting (experimental): add path pattern precedence based on specificity - AppArmor prompting (experimental): add packages to manage outstanding request prompts and rules - AppArmor prompting (experimental): add prompting API and notice types, which require snap-interfaces-requests-control interface - AppArmor prompting (experimental): feature flag can only be enabled if prompting is supported, handler service connected, and the service can be started - Registry views (experimental): rename from aspects to registries - Registry views (experimental): support reading registry views and setting/unsetting registry data using snapctl - Registry views (experimental): fetch and refresh registry assertions as needed - Registry views (experimental): restrict view paths from using a number as first character and view names to storage path style patterns - Snap components: support installing snaps and components from files at the same time (no REST API/CLI) - Snap components: support downloading components related assertions from the store - Snap components: support installing components from the store - Snap components: support removing components individually and during snap removal - Snap components: support kernel modules as components - Snap components: support for component install, pre-refresh and post-refresh hooks - Snap components: initial support for building systems that contain components - Refresh app awareness (experimental): add data field for /v2/changes REST API to allow associating each task with affected snaps - Refresh app awareness (experimental): use the app name from .desktop file in notifications - Refresh app awareness (experimental): give snap-refresh-observe interface access to /v2/snaps/{name} endpoint - Improve snap-confine compatibility with nvidia drivers - Allow re-exec when SNAP_REEXEC is set for unlisted distros to simplify testing - Allow mixing revision and channel on snap install - Generate GNU build ID for Go binaries - Add missing etelpmoc.sh for shell completion - Do not attempt to run snapd on classic when re-exec is disabled - Packaging/build maintenance for Debian sid, Fedora, Arch, openSuse - Add snap debug API command to enable running raw queries - Enable snap-confine snap mount directory detection - Replace global seccomp filter with deny rules in standard seccomp template - Remove support for Ubuntu Core Launcher (superseded by snap- confine) - Support creating pending serial bound users after serial assertion becomes available - Support disabling cloud-init using kernel command-line - In hybrid systems, apps can refresh without waiting for restarts required by essential snaps - Ship snap-debug-info.sh script used for system diagnostics - Improve error messages when attempting to run non-existent snap - Switch to -u UID:GID for strace-static - Support enabling snapd logging with snap set system debug.snapd.{log,log-level} - Add options system.coredump.enable and system.coredump.maxuse to support using systemd-coredump on Ubuntu Core - Provide documentation URL for 'snap interface ' - Fix snapd riscv64 build - Fix restarting activated services instead of their activator units (i.e. sockets, timers) - Fix potential unexpected auto-refresh of snap on managed schedule - Fix potential segfault by guarding against kernel command-line changes on classic system - Fix proxy entries in /etc/environment with missing newline that caused later manual entries to not be usable - Fix offline remodelling by ignoring prerequisites that will otherwise be downloaded from store - Fix devmode seccomp deny regression that caused spamming the log instead of actual denies - Fix snap lock leak during refresh - Fix not re-pinning validation sets that were already pinned when enforcing new validation sets - Fix handling of unexpected snapd runtime failure - Fix /v2/notices REST API skipping notices with duplicate timestamps - Fix comparing systemd versions that may contain pre-release suffixes - Fix udev potentially starting before snap-device-helper is made available - Fix race in snap seed metadata loading - Fix treating cloud-init exit status 2 as error - Fix to prevent sending refresh complete notification if snap snap- refresh-observe interface is connected - Fix to queue snapctl service commands if run from the default- configure hook to ensure they get up-to-date config values - Fix stop service failure when the service is not actually running anymore - Fix parsing /proc/PID/mounts with spaces - Add registry interface that provides snaps access to a particular registry view - Add snap-interfaces-requests-control interface to enable prompting client snaps - steam-support interface: remove all AppArmor and seccomp restrictions to improve user experience - opengl interface: improve compatibility with nvidia drivers - home interface: autoconnect home on Ubuntu Core Desktop - serial-port interface: support RPMsg tty - display-control interface: allow changing LVDS backlight power and brightness - power-control interface: support for battery charging thesholds, type/status and AC type/status - cpu-control interface: allow CPU C-state control - raw-usb interface: support RPi5 and Thinkpad x13s - custom-device interface: allow device file locking - lxd-support interface: allow LXD to self-manage its own cgroup - network-manager interface: support MPTCP sockets - network-control interface: allow plug/slot access to gnutls config and systemd resolved cache flushing via D-Bus - network-control interface: allow wpa_supplicant dbus api - gpio-control interface: support gpiochip* devices - polkit interface: fix "rw" mount option check - u2f-devices interface: enable additional security keys - desktop interface: enable kde theming support * Fri Aug 23 2024 Ernest Lotter - New upstream release 2.65 - Support building snapd using base Core22 (Snapcraft 8.x) - FIPS: support building FIPS complaint snapd variant that switches to FIPS mode when the system boots with FIPS enabled - AppArmor: update to latest 4.0.2 release - AppArmor: enable using ABI 4.0 from host parser - AppArmor: fix parser lookup - AppArmor: support AppArmor snippet priorities - AppArmor: allow reading cgroup memory.max file - AppArmor: allow using snap-exec coming from the snapd snap when starting a confined process with jailmode - AppArmor prompting (experimental): add checks for prompting support, include prompting status in system key, and restart snapd if prompting flag changes - AppArmor prompting (experimental): include prompt prefix in AppArmor rules if prompting is supported and enabled - AppArmor prompting (experimental): add common types, constraints, and mappings from AppArmor permissions to abstract permissions - AppArmor prompting (experimental): add path pattern parsing and matching - AppArmor prompting (experimental): add path pattern precedence based on specificity - AppArmor prompting (experimental): add packages to manage outstanding request prompts and rules - AppArmor prompting (experimental): add prompting API and notice types, which require snap-interfaces-requests-control interface - AppArmor prompting (experimental): feature flag can only be enabled if prompting is supported, handler service connected, and the service can be started - Registry views (experimental): rename from aspects to registries - Registry views (experimental): support reading registry views and setting/unsetting registry data using snapctl - Registry views (experimental): fetch and refresh registry assertions as needed - Registry views (experimental): restrict view paths from using a number as first character and view names to storage path style patterns - Snap components: support installing snaps and components from files at the same time (no REST API/CLI) - Snap components: support downloading components related assertions from the store - Snap components: support installing components from the store - Snap components: support removing components individually and during snap removal - Snap components: support kernel modules as components - Snap components: support for component install, pre-refresh and post-refresh hooks - Snap components: initial support for building systems that contain components - Refresh app awareness (experimental): add data field for /v2/changes REST API to allow associating each task with affected snaps - Refresh app awareness (experimental): use the app name from .desktop file in notifications - Refresh app awareness (experimental): give snap-refresh-observe interface access to /v2/snaps/{name} endpoint - Improve snap-confine compatibility with nvidia drivers - Allow re-exec when SNAP_REEXEC is set for unlisted distros to simplify testing - Allow mixing revision and channel on snap install - Generate GNU build ID for Go binaries - Add missing etelpmoc.sh for shell completion - Do not attempt to run snapd on classic when re-exec is disabled - Packaging/build maintenance for Debian sid, Fedora, Arch, openSuse - Add snap debug API command to enable running raw queries - Enable snap-confine snap mount directory detection - Replace global seccomp filter with deny rules in standard seccomp template - Remove support for Ubuntu Core Launcher (superseded by snap- confine) - Support creating pending serial bound users after serial assertion becomes available - Support disabling cloud-init using kernel command-line - In hybrid systems, apps can refresh without waiting for restarts required by essential snaps - Ship snap-debug-info.sh script used for system diagnostics - Improve error messages when attempting to run non-existent snap - Switch to -u UID:GID for strace-static - Support enabling snapd logging with snap set system debug.snapd.{log,log-level} - Add options system.coredump.enable and system.coredump.maxuse to support using systemd-coredump on Ubuntu Core - Provide documentation URL for 'snap interface ' - Fix restarting activated services instead of their activator units (i.e. sockets, timers) - Fix potential unexpected auto-refresh of snap on managed schedule - Fix potential segfault by guarding against kernel command-line changes on classic system - Fix proxy entries in /etc/environment with missing newline that caused later manual entries to not be usable - Fix offline remodelling by ignoring prerequisites that will otherwise be downloaded from store - Fix devmode seccomp deny regression that caused spamming the log instead of actual denies - Fix snap lock leak during refresh - Fix not re-pinning validation sets that were already pinned when enforcing new validation sets - Fix handling of unexpected snapd runtime failure - Fix /v2/notices REST API skipping notices with duplicate timestamps - Fix comparing systemd versions that may contain pre-release suffixes - Fix udev potentially starting before snap-device-helper is made available - Fix race in snap seed metadata loading - Fix treating cloud-init exit status 2 as error - Fix to prevent sending refresh complete notification if snap snap- refresh-observe interface is connected - Fix to queue snapctl service commands if run from the default- configure hook to ensure they get up-to-date config values - Fix stop service failure when the service is not actually running anymore - Fix parsing /proc/PID/mounts with spaces - Add registry interface that provides snaps access to a particular registry view - Add snap-interfaces-requests-control interface to enable prompting client snaps - steam-support interface: remove all AppArmor and seccomp restrictions to improve user experience - opengl interface: improve compatibility with nvidia drivers - home interface: autoconnect home on Ubuntu Core Desktop - serial-port interface: support RPMsg tty - display-control interface: allow changing LVDS backlight power and brightness - power-control interface: support for battery charging thesholds, type/status and AC type/status - cpu-control interface: allow CPU C-state control - raw-usb interface: support RPi5 and Thinkpad x13s - custom-device interface: allow device file locking - lxd-support interface: allow LXD to self-manage its own cgroup - network-manager interface: support MPTCP sockets - network-control interface: allow plug/slot access to gnutls config and systemd resolved cache flushing via D-Bus - network-control interface: allow wpa_supplicant dbus api - gpio-control interface: support gpiochip* devices - polkit interface: fix "rw" mount option check - u2f-devices interface: enable additional security keys - desktop interface: enable kde theming support * Mon Jul 29 2024 Miroslav Suchý - 2.63-3 - convert license to SPDX * Fri Jul 26 2024 Miroslav Suchý - 2.63-2 - convert license to SPDX * Wed Jul 24 2024 Ernest Lotter - New upstream release 2.64 - Support building snapd using base Core22 (Snapcraft 8.x) - FIPS: support building FIPS complaint snapd variant that switches to FIPS mode when the system boots with FIPS enabled - AppArmor: update to AppArmor 4.0.1 - AppArmor: support AppArmor snippet priorities - AppArmor prompting: add checks for prompting support, include prompting status in system key, and restart snapd if prompting flag changes - AppArmor prompting: include prompt prefix in AppArmor rules if prompting is supported and enabled - AppArmor prompting: add common types, constraints, and mappings from AppArmor permissions to abstract permissions - AppArmor prompting: add path pattern parsing and matching - Registry views (experimental): rename from aspects to registries - Registry views (experimental): support reading registry views using snapctl - Registry views (experimental): restrict view paths from using a number as first character and view names to storage path style patterns - Snap components: support installing snaps and components from files at the same time (no REST API/CLI) - Snap components: support downloading components related assertions from the store - Snap components: support installing components from the store (no REST API/CLI) - Snap components: support removing components (REST API, no CLI) - Snap components: started support for component hooks - Snap components: support kernel modules as components - Refresh app awareness (experimental): add data field for /v2/changes REST API to allow associating each task with affected snaps - Refresh app awareness (experimental): use the app name from .desktop file in notifications - Refresh app awareness (experimental): give snap-refresh-observe interface access to /v2/snaps/{name} endpoint - Allow re-exec when SNAP_REEXEC is set for unlisted distros to simplify testing - Generate GNU build ID for Go binaries - Add missing etelpmoc.sh for shell completion - Do not attempt to run snapd on classic when re-exec is disabled - Packaging/build maintenance for Debian sid, Fedora, Arch, openSuse - Add snap debug api command to enable running raw queries - Enable snap-confine snap mount directory detection - Replace global seccomp filter with deny rules in standard seccomp template - Remove support for Ubuntu Core Launcher (superseded by snap- confine) - Support creating pending serial bound users after serial assertion becomes available - Support disabling cloud-init using kernel command-line - In hybrid systems, apps can refresh without waiting for restarts required by essential snaps - Ship snap-debug-info.sh script used for system diagnostics - Improve error messages when attempting to run non-existent snap - Switch to -u UID:GID for strace-static - Support enabling snapd logging with snap set system debug.snapd.{log,log-level} - Fix restarting activated services instead of their activator units (i.e. sockets, timers) - Fix potential unexpected auto-refresh of snap on managed schedule - Fix potential segfault by guarding against kernel command-line changes on classic system - Fix proxy entries in /etc/environment with missing newline that caused later manual entries to not be usable - Fix offline remodelling by ignoring prerequisites that will otherwise be downloaded from store - Fix devmode seccomp deny regression that caused spamming the log instead of actual denies - Fix snap lock leak during refresh - Fix not re-pinning validation sets that were already pinned when enforcing new validation sets - Fix handling of unexpected snapd runtime failure - Fix /v2/notices REST API skipping notices with duplicate timestamps - Fix comparing systemd versions that may contain pre-release suffixes - Fix udev potentially starting before snap-device-helper is made available - Fix race in snap seed metadata loading - Fix treating cloud-init exit status 2 as error - Fix to prevent sending refresh complete notification if snap snap- refresh-observe interface is connected - Fix to queue snapctl service commands if run from the default- configure hook to ensure they get up-to-date config values - Fix stop service failure when the service is not actually running anymore - Add registry interface that provides snaps access to a particular registry view - steam-support interface: relaxed AppArmor and seccomp restrictions to improve user experience - home interface: autoconnect home on Ubuntu Core Desktop - serial-port interface: support RPMsg tty - display-control interface: allow changing LVDS backlight power and brightness - power-control interface: support for battery charging thesholds, type/status and AC type/status - cpu-control interface: allow CPU C-state control - raw-usb interface: support RPi5 and Thinkpad x13s - custom-device interface: allow device file locking - lxd-support interface: allow LXD to self-manage its own cgroup - network-manager interface: support MPTCP sockets - network-control interface: allow plug/slot access to gnutls config and systemd resolved cache flushing via D-Bus * Sat Jul 20 2024 Fedora Release Engineering - 2.63-1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild * Wed Apr 24 2024 Ernest Lotter - New upstream release 2.63 - Support for snap services to show the current status of user services (experimental) - Refresh app awareness: record snap-run-inhibit notice when starting app from snap that is busy with refresh (experimental) - Refresh app awareness: use warnings as fallback for desktop notifications (experimental) - Aspect based configuration: make request fields in the aspect- bundle's rules optional (experimental) - Aspect based configuration: make map keys conform to the same format as path sub-keys (experimental) - Aspect based configuration: make unset and set behaviour similar to configuration options (experimental) - Aspect based configuration: limit nesting level for setting value (experimental) - Components: use symlinks to point active snap component revisions - Components: add model assertion support for components - Components: fix to ensure local component installation always gets a new revision number - Add basic support for a CIFS remote filesystem-based home directory - Add support for AppArmor profile kill mode to avoid snap-confine error - Allow more than one interface to grant access to the same API endpoint or notice type - Allow all snapd service's control group processes to send systemd notifications to prevent warnings flooding the log - Enable not preseeded single boot install - Update secboot to handle new sbatlevel - Fix to not use cgroup for non-strict confined snaps (devmode, classic) - Fix two race conditions relating to freedesktop notifications - Fix missing tunables in snap-update-ns AppArmor template - Fix rejection of snapd snap udev command line by older host snap- device-helper - Rework seccomp allow/deny list - Clean up files removed by gadgets - Remove non-viable boot chains to avoid secboot failure - posix_mq interface: add support for missing time64 mqueue syscalls mq_timedreceive_time64 and mq_timedsend_time64 - password-manager-service interface: allow kwalletd version 6 - kubernetes-support interface: allow SOCK_SEQPACKET sockets - system-observe interface: allow listing systemd units and their properties - opengl interface: enable use of nvidia container toolkit CDI config generation * Thu Mar 21 2024 Ernest Lotter - New upstream release 2.62 - Aspects based configuration schema support (experimental) - Refresh app awareness support for UI (experimental) - Support for user daemons by introducing new control switches --user/--system/--users for service start/stop/restart (experimental) - Add AppArmor prompting experimental flag (feature currently unsupported) - Installation of local snap components of type test - Packaging of components with snap pack - Expose experimental features supported/enabled in snapd REST API endpoint /v2/system-info - Support creating and removing recovery systems for use by factory reset - Enable API route for creating and removing recovery systems using /v2/systems with action create and /v2/systems/{label} with action remove - Lift requirements for fde-setup hook for single boot install - Enable single reboot gadget update for UC20+ - Allow core to be removed on classic systems - Support for remodeling on hybrid systems - Install desktop files on Ubuntu Core and update after snapd upgrade - Upgrade sandbox features to account for cgroup v2 device filtering - Support snaps to manage their own cgroups - Add support for AppArmor 4.0 unconfined profile mode - Add AppArmor based read access to /etc/default/keyboard - Upgrade to squashfuse 0.5.0 - Support useradd utility to enable removing Perl dependency for UC24+ - Support for recovery-chooser to use console-conf snap - Add support for --uid/--gid using strace-static - Add support for notices (from pebble) and expose via the snapd REST API endpoints /v2/notices and /v2/notice - Add polkit authentication for snapd REST API endpoints /v2/snaps/{snap}/conf and /v2/apps - Add refresh-inhibit field to snapd REST API endpoint /v2/snaps - Add refresh-inhibited select query to REST API endpoint /v2/snaps - Take into account validation sets during remodeling - Improve offline remodeling to use installed revisions of snaps to fulfill the remodel revision requirement - Add rpi configuration option sdtv_mode - When snapd snap is not installed, pin policy ABI to 4.0 or 3.0 if present on host - Fix gadget zero-sized disk mapping caused by not ignoring zero sized storage traits - Fix gadget install case where size of existing partition was not correctly taken into account - Fix trying to unmount early kernel mount if it does not exist - Fix restarting mount units on snapd start - Fix call to udev in preseed mode - Fix to ensure always setting up the device cgroup for base bare and core24+ - Fix not copying data from newly set homedirs on revision change - Fix leaving behind empty snap home directories after snap is removed (resulting in broken symlink) - Fix to avoid using libzstd from host by adding to snapd snap - Fix autorefresh to correctly handle forever refresh hold - Fix username regex allowed for system-user assertion to not allow '+' - Fix incorrect application icon for notification after autorefresh completion - Fix to restart mount units when changed - Fix to support AppArmor running under incus - Fix case of snap-update-ns dropping synthetic mounts due to failure to match desired mount dependencies - Fix parsing of base snap version to enable pre-seeding of Ubuntu Core Desktop - Fix packaging and tests for various distributions - Add remoteproc interface to allow developers to interact with Remote Processor Framework which enables snaps to load firmware to ARM Cortex microcontrollers - Add kernel-control interface to enable controlling the kernel firmware search path - Add nfs-mount interface to allow mounting of NFS shares - Add ros-opt-data interface to allow snaps to access the host /opt/ros/ paths - Add snap-refresh-observe interface that provides refresh-app- awareness clients access to relevant snapd API endpoints - steam-support interface: generalize Pressure Vessel root paths and allow access to driver information, features and container versions - steam-support interface: make implicit on Ubuntu Core Desktop - desktop interface: improved support for Ubuntu Core Desktop and limit autoconnection to implicit slots - cups-control interface: make autoconnect depend on presence of cupsd on host to ensure it works on classic systems - opengl interface: allow read access to /usr/share/nvidia - personal-files interface: extend to support automatic creation of missing parent directories in write paths - network-control interface: allow creating /run/resolveconf - network-setup-control and network-setup-observe interfaces: allow busctl bind as required for systemd 254+ - libvirt interface: allow r/w access to /run/libvirt/libvirt-sock- ro and read access to /var/lib/libvirt/dnsmasq/** - fwupd interface: allow access to IMPI devices (including locking of device nodes), sysfs attributes needed by amdgpu and the COD capsule update directory - uio interface: allow configuring UIO drivers from userspace libraries - serial-port interface: add support for NXP Layerscape SoC - lxd-support interface: add attribute enable-unconfined-mode to require LXD to opt-in to run unconfined - block-devices interface: add support for ZFS volumes - system-packages-doc interface: add support for reading jquery and sphinx documentation - system-packages-doc interface: workaround to prevent autoconnect failure for snaps using base bare - microceph-support interface: allow more types of block devices to be added as an OSD - mount-observe interface: allow read access to /proc/{pid}/task/{tid}/mounts and proc/{pid}/task/{tid}/mountinfo - polkit interface: changed to not be implicit on core because installing policy files is not possible - upower-observe interface: allow stats refresh - gpg-public-keys interface: allow creating lock file for certain gpg operations - shutdown interface: allow access to SetRebootParameter method - media-control interface: allow device file locking - u2f-devices interface: support for Trustkey G310H, JaCarta U2F, Kensington VeriMark Guard, RSA DS100, Google Titan v2 * Wed Mar 06 2024 Ernest Lotter - New upstream release 2.61.3 - Install systemd files in correct location for 24.04 * Fri Feb 16 2024 Ernest Lotter - New upstream release 2.61.2 - Fix to enable plug/slot sanitization for prepare-image - Fix panic when device-service.access=offline - Support offline remodeling - Allow offline update only remodels without serial - Fail early when remodeling to old model revision - Fix to enable plug/slot sanitization for validate-seed - Allow removal of core snap on classic systems - Fix network-control interface denial for file lock on /run/netns - Add well-known core24 snap-id - Fix remodel snap installation order - Prevent remodeling from UC18+ to UC16 - Fix cups auto-connect on classic with cups snap installed - u2f-devices interface support for GoTrust Idem Key with USB-C - Fix to restore services after unlink failure - Add libcudnn.so to Nvidia libraries - Fix skipping base snap download due to false snapd downgrade conflict * Sun Feb 11 2024 Maxwell G - 2.61.1-2 - Rebuild for golang 1.22.0 * Sat Jan 27 2024 Fedora Release Engineering - 2.61.1-1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild * Thu Jan 18 2024 Zygmunt Krynicki - 2.61.1-1 - Changelog resynchronization * Wed Jan 17 2024 Zygmunt Krynicki - 2.58.3-3 - Require xdelta on Fedora or EPEL >= 9 (for delta updates) * Fri Nov 24 2023 Ernest Lotter - New upstream release 2.61.1 - Stop requiring default provider snaps on image building and first boot if alternative providers are included and available - Fix auth.json access for login as non-root group ID - Fix incorrect remodelling conflict when changing track to older snapd version - Improved check-rerefresh message - Fix UC16/18 kernel/gadget update failure due volume mismatch with installed disk - Stop auto-import of assertions during install modes - Desktop interface exposes GetIdletime - Polkit interface support for new polkit versions - Fix not applying snapd snap changes in tracked channel when remodelling * Fri Oct 13 2023 Philip Meulengracht - New upstream release 2.61 - Fix control of activated services in 'snap start' and 'snap stop' - Correctly reflect activated services in 'snap services' - Disabled services are no longer enabled again when snap is refreshed - interfaces/builtin: added support for Token2 U2F keys - interfaces/u2f-devices: add Swissbit iShield Key - interfaces/builtin: update gpio apparmor to match pattern that contains multiple subdirectories under /sys/devices/platform - interfaces: add a polkit-agent interface - interfaces: add pcscd interface - Kernel command-line can now be edited in the gadget.yaml - Only track validation-sets in run-mode, fixes validation-set issues on first boot. - Added support for using store.access to disable access to snap store - Support for fat16 partition in gadget - Pre-seed authority delegation is now possible - Support new system-user name daemon - Several bug fixes and improvements around remodelling - Offline remodelling support * Fri Sep 15 2023 Michael Vogt - New upstream release 2.60.4 - i/b/qualcomm_ipc_router.go: switch to plug/slot and add socket permission - interfaces/builtin: fix custom-device udev KERNEL values - overlord: allow the firmware-updater snap to install user daemons - interfaces: allow loopback as a block-device * Fri Aug 25 2023 Michael Vogt - New upstream release 2.60.3 - i/b/shared-memory: handle "private" plug attribute in shared- memory interface correctly - i/apparmor: support for home.d tunables from /etc/ * Fri Aug 04 2023 Michael Vogt - New upstream release 2.60.2 - i/builtin: allow directories in private /dev/shm - i/builtin: add read access to /proc/task/schedstat in system- observe - snap-bootstrap: print version information at startup - go.mod: update gopkg.in/yaml.v3 to v3.0.1 to fix CVE-2022-28948 - snap, store: filter out invalid snap edited links from store info and persisted state - o/configcore: write netplan defaults to 00-snapd-config on seeding - snapcraft.yaml: pull in apparmor_parser optimization patches from https://gitlab.com/apparmor/apparmor/-/merge_requests/711 - snap-confine: fix missing \0 after readlink - cmd/snap: hide append-integrity-data - interfaces/opengl: add support for ARM Mali * Sat Jul 22 2023 Fedora Release Engineering - 2.58.3-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild * Tue Jul 04 2023 Michael Vogt - New upstream release 2.60.1 - install: fallback to lazy unmount() in writeFilesystemContent - data: include "modprobe.d" and "modules-load.d" in preseeded blob - gadget: fix install test on armhf - interfaces: fix typo in network_manager_observe - sandbox/apparmor: don't let vendored apparmor conflict with system - gadget/update: set parts in laid out data from the ones matched - many: move SnapConfineAppArmorDir from dirs to sandbox/apparmor - many: stop using `-O no-expr-simplify` in apparmor_parser - go.mod: update secboot to latest uc22 branch * Thu Jun 15 2023 Michael Vogt - New upstream release 2.60 - Support for dynamic snapshot data exclusions - Apparmor userspace is vendored inside the snapd snap - Added a default-configure hook that exposes gadget default configuration options to snaps during first install before services are started - Allow install from initrd to speed up the initial installation for systems that do not have a install-device hook - New `snap sign --chain` flag that appends the account and account-key assertions - Support validation-sets in the model assertion - Support new "min-size" field in gadget.yaml - New interface: "userns" * Sat May 27 2023 Michael Vogt - New upstream release 2.59.5 - Explicitly disallow the use of ioctl + TIOCLINUX This fixes CVE-2023-1523. * Fri May 12 2023 Michael Vogt - New upstream release 2.59.4 - Retry when looking for disk label on non-UEFI systems (LP: #2018977) - Fix remodel from UC20 to UC22 * Wed May 03 2023 Michael Vogt - New upstream release 2.59.3 - Fix quiet boot - i/b/physical_memory_observe: allow reading virt-phys page mappings - gadget: warn instead of returning error if overlapping with GPT header - overlord,wrappers: restart always enabled units - go.mod: update github.com/snapcore/secboot to latest uc22 - boot: make sure we update assets for the system-seed-null role - many: ignore case for vfat partitions when validating * Tue Apr 18 2023 Michael Vogt - New upstream release 2.59.2 - Notify users when a user triggered auto refresh finished * Tue Mar 28 2023 Michael Vogt - New upstream release 2.59.1 - Add udev rules from steam-devices to steam-support interface - Bugfixes for layout path checking, dm_crypt permissions, mount-control interface parameter checking, kernel commandline parsing, docker-support, refresh-app-awareness * Fri Mar 10 2023 Michael Vogt - New upstream release 2.59 - Support setting extra kernel command line parameters via snap configuration and under a gadget allow-list - Support for Full-Disk-Encryption using ICE - Support for arbitrary home dir locations via snap configuration - New nvidia-drivers-support interface - Support for udisks2 snap - Pre-download of snaps ready for refresh and automatic refresh of the snap when all apps are closed - New microovn interface - Support uboot with `CONFIG_SYS_REDUNDAND_ENV=n` - Make "snap-preseed --reset" re-exec when needed - Update the fwupd interface to support fully confined fwupd - The memory,cpu,thread quota options are no longer experimental - Support debugging snap client requests via the `SNAPD_CLIENT_DEBUG_HTTP` environment variable - Support ssh listen-address via snap configuration - Support for quotas on single services - prepare-image now takes into account snapd versions going into the image, including in the kernel initrd, to fetch supported assertion formats * Sat Feb 25 2023 Maciek Borzecki - 2.58.3-1 - Releate 2.58.3 to Fedora RHBZ#2173056 * Tue Feb 21 2023 Michael Vogt - New upstream release 2.58.3 - interfaces/screen-inhibit-control: Add support for xfce-power- manager - interfaces/network-manager: do not show ptrace read denials - interfaces: relax rules for mount-control `what` for functionfs - cmd/snap-bootstrap: add support for snapd_system_disk - interfaces/modem-manager: add net_admin capability - interfaces/network-manager: add permission for OpenVPN - httputil: fix checking x509 certification error on go 1.20 - i/b/fwupd: allow reading host os-release - boot: on classic+modes `MarkBootSuccessfull` does not need a base - boot: do not include `base=` in modeenv for classic+modes installs - tests: add spread test that validates revert on boot for core does not happen on classic+modes - snapstate: only take boot participants into account in UpdateBootRevisions - snapstate: refactor UpdateBootRevisions() to make it easier to check for boot.SnapTypeParticipatesInBoot() * Wed Jan 25 2023 Michael Vogt - New upstream release 2.58.2 - bootloader: fix dirty build by hardcoding copyright year * Mon Jan 23 2023 Michael Vogt - New upstream release 2.58.1 - secboot: detect lockout mode in CheckTPMKeySealingSupported - cmd/snap-update-ns: prevent keeping unneeded mountpoints - o/snapstate: do not infinitely retry when an update fails during seeding - interfaces/modem-manager: add permissions for NETLINK_ROUTE - systemd/emulation.go: use `systemctl --root` to enable/disable - snap: provide more error context in `NotSnapError` - interfaces: add read access to /run for cryptsetup - boot: avoid reboot loop if there is a bad try kernel - devicestate: retry serial acquire on time based certificate errors - o/devicestate: run systemctl daemon-reload after install-device hook - cmd/snap,daemon: add 'held' to notes in 'snap list' - o/snapshotstate: check snapshots are self-contained on import - cmd/snap: show user+gating hold info in 'snap info' - daemon: expose user and gating holds at /v2/snaps/{name} * Sat Jan 21 2023 Fedora Release Engineering - 2.57.6-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild * Fri Dec 16 2022 Maciek Borzecki - 2.57.6-2 - Fix for RHBZ#2152903 * Thu Dec 01 2022 Michael Vogt - New upstream release 2.58 - many: Use /tmp/snap-private-tmp for per-snap private tmps - data: Add systemd-tmpfiles configuration to create private tmp dir - cmd/snap: test allowed and forbidden refresh hold values - cmd/snap: be more consistent in --hold help and err messages - cmd/snap: error on refresh holds that are negative or too short - o/homedirs: make sure we do not write to /var on build time - image: make sure file customizations happen also when we have defaultscause - tests/fde-on-classic: set ubuntu-seed label in seed partitions - gadget: system-seed-null should also have fs label ubuntu-seed - many: gadget.HasRole, ubuntu-seed can come also from system-seed- null - o/devicestate: fix paths for retrieving recovery key on classic - cmd/snap-confine: do not discard const qualifier - interfaces: allow python3.10+ in the default template - o/restart: fix PendingForSystemRestart - interfaces: allow wayland slot snaps to access shm files created by Firefox - o/assertstate: add Sequence() to val set tracking - o/assertstate: set val set 'Current' to pinned sequence - tests: tweak the libvirt interface test to work on 22.10 - tests: use system-seed-null role on classic with modes tests - boot: add directory for data on install - o/devicestate: change some names from esp to seed/seed-null - gadget: add system-seed-null role - o/devicestate: really add error to new error message - restart,snapstate: implement reboot-required notifications on classic - many: avoid automatic system restarts on classic through new overlord/restart logic - release: Fix WSL detection in LXD - o/state: introduce WaitStatus - interfaces: Fix desktop interface rules for document portal - client: remove classic check for `snap recovery --show- keys` - many: create snapd.mounts targets to schedule mount units - image: enable sysfs overlay for UC preseeding - i/b/network-control: add permissions for using AF_XDP - i/apparmor: move mocking of home and overlay conditions to osutil - tests/main/degraded: ignore man-db update failures in CentOS - cmd/snap: fix panic when running snap w/ flag but w/o subcommand - tests: save snaps generated during image preaparation - tests: skip building snapd based on new env var - client: remove misleading comments in ValidateApplyOptions - boot/seal: add debug traces for bootchains - bootloader/assets: fix grub.cfg when there are no labels - cmd/snap: improve refresh hold's output - packaging: enable BPF in RHEL9 - packaging: do not traverse filesystems in postrm script - tests: get microk8s from another branch - bootloader: do not specify Core version in grub entry - many: refresh --hold follow-up - many: support refresh hold/unhold to API and CLI - many: expand fully handling links mapping in all components, in the API and in snap info - snap/system_usernames,tests: Azure IoT Edge system usernames - interface: Allow access to org.freedesktop.DBus.ListActivatableNames via system-observe interface - o/devicestate,daemon: use the expiration date from the assertion in user-state and REST api (user-removal 4/n) - gadget: add unit tests for new install functions for FDE on classic - cmd/snap-seccomp: fix typo in AF_XDP value - tests/connected-after-reboot-revert: run also on UC16 - kvm: allow read of AMD-SEV parameters - data: tweak apt integration config var - o/c/configcore: add faillock configuration - tests: use dbus-daemon instead of dbus-launch - packaging: remove unclean debian-sid patch - asserts: add keyword 'user-presence' keyword in system-user assertion (auto-removal 3/n) - interfaces: steam-support allow pivot /run/media and /etc/nvidia mount - aspects: initial code - overlord: process auto-import assertion at first boot - release, snapd-apparmor, syscheck: distinguish WSL1 and WSL2 - tests: fix lxd-mount-units in ubuntu kinetic - tests: new variable used to configure the kernel command line in nested tests - go.mod: update to newer secboot/uc22 branch - autopkgtests: fix running autopkgtest on kinetic - tests: remove squashfs leftovers in fakeinstaller - tests: create partition table in fakeinstaller - o/ifacestate: introduce DebugAutoConnectCheck hook - tests: use test-snapd-swtpm instead of swtpm-mvo snap in nested helper - interfaces/polkit: do not require polkit directory if no file is needed - o/snapstate: be consistent not creating per-snap save dirs for classic models - inhibit: use hintFile() - tests: use `snap prepare-image` in fde-on-classic mk-image.sh - interfaces: add microceph interface - seccomp: allow opening XDP sockets - interfaces: allow access to icon subdirectories - tests: add minimal-smoke test for UC22 and increase minimal RAM - overlord: introduce hold levels in the snapstate.Hold* API - o/devicestate: support mounting ubuntu-save also on classic with modes - interfaces: steam-support allow additional mounts - fakeinstaller: format SystemDetails result with %+v - cmd/libsnap-confine-private: do not panic on chmod failure - tests: ensure that fakeinstaller put the seed into the right place - many: add stub services for prompting - tests: add libfwupd and libfwupdplugin5 to openSUSE dependencies - o/snapstate: fix snaps-hold pruning/reset in the presence of system holding - many: add support for setting up encryption from installer - many: support classic snaps in the context of classic and extended models - cmd/snap,daemon: allow zero values from client to daemon for journal rate limit - boot,o/devicestate: extend HasFDESetupHook to consider unrelated kernels - cmd/snap: validation set refresh-enforce CLI support + spread test - many: fix filenames written in modeenv for base/gadget plus drive- by TODO - seed: fix seed test to use a pseudo-random byte sequence - cmd/snap-confine: remove setuid calls from cgroup init code - boot,o/devicestate: introduce and use MakeRunnableStandaloneSystem - devicestate,boot,tests: make `fakeinstaller` test work - store: send Snap-Device-Location header with cloud information - overlord: fix unit tests after merging master in - o/auth: move HasUserExpired into UserState and name it HasExpired, and add unit tests for this - o/auth: rename NewUserData to NewUserParams - many: implementation of finish install step handlers - overlord: auto-resolve validation set enforcement constraints - i/backends,o/ifacestate: cleanup backends.All - cmd/snap-confine: move bind-mount setup into separate function - tests/main/mount-ns: update namespace for 18.04 - o/state: Hold pseudo-error for explicit holding, concept of pending changes in prune logic - many: support extended classic models that omit kernel/gadget - data/selinux: allow snapd to detect WSL - overlord: add code to remove users that has an expiration date set - wrappers,snap/quota: clear LogsDirectory= in the service unit for journal namespaces - daemon: move user add, remove operations to overlord device state - gadget: implement write content from gadget information - {device,snap}state: fix ineffectual assignments - daemon: support validation set refresh+enforce in API - many: rename AddAffected* to RegisterAffected*, add Change|State.Has, fix a comment - many: reset store session when setting proxy.store - overlord/ifacestate: fix conflict detection of auto-connection - interfaces: added read/write access to /proc/self/coredump_filter for process-control - interfaces: add read access to /proc/cgroups and /proc/sys/vm/swappiness to system-observe - fde: run fde-reveal-key with `DefaultDependencies=no` - many: don't concatenate non-constant format strings - o/devicestate: fix non-compiling test - release, snapd-apparmor: fixed outdated WSL detection - many: add todos discussed in the review in tests/nested/manual/fde-on-classic, snapstate cleanups - overlord: run install-device hook during factory reset - i/b/mount-control: add optional `/` to umount rules - gadget/install: split Run in several functions - o/devicestate: refactor some methods as preparation for install steps implementation - tests: fix how snaps are cached in uc22 - tests/main/cgroup-tracking-failure: fix rare failure in Xenial and Bionic - many: make {Install,Initramfs}{{,Host},Writable}Dir a function - tests/nested/manual/core20: fix manual test after changes to 'tests.nested exec' - tests: move the unit tests system to 22.04 in github actions workflow - tests: fix nested errors uc20 - boot: rewrite switch in SnapTypeParticipatesInBoot() - gadget: refactor to allow usage from the installer - overlord/devicestate: support for mounting ubuntu-save before the install-device hook - many: allow to install/update kernels/gadgets on classic with modes - tests: fix issues related to dbus session and localtime in uc18 - many: support home dirs located deeper under /home - many: refactor tests to use explicit strings instead of boot.Install{Initramfs,Host}{Writable,FDEData}Dir - boot: add factory-reset cases for boot-flags - tests: disable quota tests on arm devices using ubuntu core - tests: fix unbound SPREAD_PATH variable on nested debug session - overlord: start turning restart into a full state manager - boot: apply boot logic also for classic with modes boot snaps - tests: fix snap-env test on debug section when no var files were created - overlord,daemon: allow returning errors when requesting a restart - interfaces: login-session-control: add further D-Bus interfaces - snapdenv: added wsl to userAgent - o/snapstate: support running multiple ops transactionally - store: use typed valset keys in store package - daemon: add `ensureStateSoon()` when calling systems POST api - gadget: add rules for validating classic with modes gadget.yaml files - wrappers: journal namespaces did not honor journal.persistent - many: stub devicestate.Install{Finish,SetupStorageEncryption}() - sandbox/cgroup: don't check V1 cgroup if V2 is active - seed: add support to load auto import assertion - tests: fix preseed tests for arm systems - include/lk: update LK recovery environment definition to include device lock state used by bootloader - daemon: return `storage-encryption` in /systems/