diff --git a/.gitignore b/.gitignore index 24dca27..981b550 100644 --- a/.gitignore +++ b/.gitignore @@ -1,106 +1,4 @@ -/snapcore-selinux-6331fd4.tar.gz -/snapd-2.16.tar.gz -/snapcore-selinux-e5c1177.tar.gz -/snapcore-selinux-4566045.tar.gz -/snapd-2.23.6.tar.gz -/snapd-2.24.tar.gz -/snapd-2.25.tar.gz -/snapd-2.26.3.tar.gz -/snapd-2.27.tar.gz -/snapd-2.27.1.tar.gz -/snapd-2.27.2.tar.gz -/snapd-2.27.5.tar.gz -/snapd-2.27.6.tar.gz -/snapd-2.28.1.tar.gz -/snapd-2.28.4.tar.gz -/snapd-2.28.5.tar.gz -/snapd-2.29.4.tar.gz -/snapd-2.30.tar.gz -/snapd-2.31.1.tar.gz -/snapd-2.32.4.tar.gz -/snapd-2.33.1.tar.gz -/snapd-2.35.tar.gz -/snapd-2.36.tar.gz -/snapd_2.36.only-vendor.tar.xz -/snapd-2.36.3.tar.gz -/snapd_2.36.3.only-vendor.tar.xz -/snapd-2.37.2.tar.gz -/snapd_2.37.2.only-vendor.tar.xz -/snapd-2.37.3.tar.gz -/snapd_2.37.3.only-vendor.tar.xz -/snapd-2.37.4.tar.gz -/snapd_2.37.4.only-vendor.tar.xz -/snapd_2.38.no-vendor.tar.xz -/snapd_2.38.only-vendor.tar.xz -/snapd_2.39.no-vendor.tar.xz -/snapd_2.39.only-vendor.tar.xz -/snapd_2.39.1.no-vendor.tar.xz -/snapd_2.39.1.only-vendor.tar.xz -/snapd_2.39.2.no-vendor.tar.xz -/snapd_2.39.2.only-vendor.tar.xz -/snapd_2.41.no-vendor.tar.xz -/snapd_2.41.only-vendor.tar.xz -/snapd_2.42.no-vendor.tar.xz -/snapd_2.42.only-vendor.tar.xz -/snapd_2.42.1.no-vendor.tar.xz -/snapd_2.42.1.only-vendor.tar.xz -/snapd_2.42.2.no-vendor.tar.xz -/snapd_2.42.2.only-vendor.tar.xz -/snapd_2.43.3.no-vendor.tar.xz -/snapd_2.43.3.only-vendor.tar.xz -/snapd_2.45.no-vendor.tar.xz -/snapd_2.45.only-vendor.tar.xz -/snapd_2.45.1.no-vendor.tar.xz -/snapd_2.45.1.only-vendor.tar.xz -/snapd_2.45.2.no-vendor.tar.xz -/snapd_2.45.2.only-vendor.tar.xz -/snapd_2.45.3.1.no-vendor.tar.xz -/snapd_2.45.3.1.only-vendor.tar.xz -/snapd_2.46.1.no-vendor.tar.xz -/snapd_2.46.1.only-vendor.tar.xz -/snapd_2.47.1.no-vendor.tar.xz -/snapd_2.47.1.only-vendor.tar.xz -/snapd_2.48.2.no-vendor.tar.xz -/snapd_2.48.2.only-vendor.tar.xz -/snapd_2.49.no-vendor.tar.xz -/snapd_2.49.only-vendor.tar.xz -/snapd_2.50.no-vendor.tar.xz -/snapd_2.50.only-vendor.tar.xz -/snapd_2.51.no-vendor.tar.xz -/snapd_2.51.only-vendor.tar.xz -/snapd_2.51.7.no-vendor.tar.xz -/snapd_2.51.7.only-vendor.tar.xz -/snapd_2.52.no-vendor.tar.xz -/snapd_2.52.only-vendor.tar.xz -/snapd_2.53.1.no-vendor.tar.xz -/snapd_2.53.1.only-vendor.tar.xz -/snapd_2.53.2.no-vendor.tar.xz -/snapd_2.53.2.only-vendor.tar.xz -/snapd_2.53.4.no-vendor.tar.xz -/snapd_2.53.4.only-vendor.tar.xz -/snapd_2.54.1.no-vendor.tar.xz -/snapd_2.54.1.only-vendor.tar.xz -/snapd_2.54.2.no-vendor.tar.xz -/snapd_2.54.2.only-vendor.tar.xz -/snapd_2.54.3.no-vendor.tar.xz -/snapd_2.54.3.only-vendor.tar.xz -/snapd_2.54.4.no-vendor.tar.xz -/snapd_2.54.4.only-vendor.tar.xz -/snapd_2.55.2.no-vendor.tar.xz -/snapd_2.55.2.only-vendor.tar.xz -/snapd_2.55.3.no-vendor.tar.xz -/snapd_2.55.3.only-vendor.tar.xz -/snapd_2.56.2.no-vendor.tar.xz -/snapd_2.56.2.only-vendor.tar.xz -/snapd_2.57.5.no-vendor.tar.xz -/snapd_2.57.5.only-vendor.tar.xz -/snapd_2.57.6.no-vendor.tar.xz -/snapd_2.57.6.only-vendor.tar.xz -/snapd_2.58.3.no-vendor.tar.xz -/snapd_2.58.3.only-vendor.tar.xz -/snapd_2.61.1.no-vendor.tar.xz -/snapd_2.61.1.only-vendor.tar.xz -/snapd_2.61.2.no-vendor.tar.xz -/snapd_2.61.2.only-vendor.tar.xz -/snapd_2.62.no-vendor.tar.xz -/snapd_2.62.only-vendor.tar.xz +/snapd_2.71.no-vendor.tar.xz +/snapd_2.71.only-vendor.tar.xz +/snapd_2.72.no-vendor.tar.xz +/snapd_2.72.only-vendor.tar.xz diff --git a/snapd.spec b/snapd.spec index 81658ad..073ba90 100644 --- a/snapd.spec +++ b/snapd.spec @@ -52,27 +52,32 @@ %global provider_prefix %{provider}.%{provider_tld}/%{project}/%{repo} %global import_path %{provider_prefix} -%global snappy_svcs snapd.service snapd.socket snapd.autoimport.service snapd.seeded.service snapd.mounts.target snapd.mounts-pre.target +%global snappy_svcs snapd.service snapd.socket snapd.seeded.service snapd.apparmor.service snapd.mounts.target snapd.mounts-pre.target %global snappy_user_svcs snapd.session-agent.service snapd.session-agent.socket +# Note that packaging for Fedora does omit cap_setgid and cap_setuid that are +# only required to use snapd in user namespaces when the host system uses +# cgroup-v1 hierarchy. Since no actively supported Fedora release uses cgroup +# v1, those capabilities are omitted. +%global snap_confine_caps cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_sys_chroot,cap_sys_ptrace,cap_sys_admin=p # Until we have a way to add more extldflags to gobuild macro... # Always use external linking when building static binaries. %if 0%{?fedora} || 0%{?rhel} >= 8 -%define gobuild_static(o:) go build -buildmode pie -compiler gc -tags="rpm_crashtraceback ${BUILDTAGS:-}" -ldflags "-B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \\n') -linkmode external -extldflags '%__global_ldflags -static'" -a -v -x %{?**}; +%define gobuild_static(o:) go build -buildmode pie -compiler gc -tags="rpm_crashtraceback ${BUILDTAGS:-}" -ldflags "-B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \\n') -linkmode external -extldflags '%__global_ldflags -static'" -a -v %{?**}; %endif %if 0%{?rhel} == 7 # no pass PIE flags due to https://bugzilla.redhat.com/show_bug.cgi?id=1634486 -%define gobuild_static(o:) go build -compiler gc -tags="rpm_crashtraceback ${BUILDTAGS:-}" -ldflags "-B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \\n') -linkmode external -extldflags '%__global_ldflags -static'" -a -v -x %{?**}; +%define gobuild_static(o:) go build -compiler gc -tags="rpm_crashtraceback ${BUILDTAGS:-}" -ldflags "-B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \\n') -linkmode external -extldflags '%__global_ldflags -static'" -a -v %{?**}; %endif # These macros are missing BUILDTAGS in RHEL 8/9, see RHBZ#1825138 %if 0%{?rhel} >= 8 -%define gobuild(o:) go build -buildmode pie -compiler gc -tags="rpm_crashtraceback ${BUILDTAGS:-}" -ldflags "-B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \\n') -linkmode external -extldflags '%__global_ldflags'" -a -v -x %{?**}; +%define gobuild(o:) go build -buildmode pie -compiler gc -tags="rpm_crashtraceback ${BUILDTAGS:-}" -ldflags "-B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \\n') -linkmode external -extldflags '%__global_ldflags'" -a -v %{?**}; %endif # These macros are not defined in RHEL 7 %if 0%{?rhel} == 7 -%define gobuild(o:) go build -compiler gc -tags="rpm_crashtraceback ${BUILDTAGS:-}" -ldflags "-B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \\n') -linkmode external -extldflags '%__global_ldflags'" -a -v -x %{?**}; +%define gobuild(o:) go build -compiler gc -tags="rpm_crashtraceback ${BUILDTAGS:-}" -ldflags "-B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \\n') -linkmode external -extldflags '%__global_ldflags'" -a -v %{?**}; %define gotest() go test -compiler gc %{?**}; %endif @@ -83,10 +88,10 @@ %{!?_tmpfilesdir: %global _tmpfilesdir %{_prefix}/lib/tmpfiles.d} Name: snapd -Version: 2.62 -Release: 0%{?dist} +Version: 2.72 +Release: 1%{?dist} Summary: A transactional software package manager -License: GPLv3 +License: GPL-3.0-only URL: https://%{provider_prefix} Source0: https://%{provider_prefix}/releases/download/%{version}/%{name}_%{version}.no-vendor.tar.xz Source1: https://%{provider_prefix}/releases/download/%{version}/%{name}_%{version}.only-vendor.tar.xz @@ -132,10 +137,11 @@ Provides: %{name}-login-service%{?_isa} = 1.33 %endif %if ! 0%{?with_bundled} -BuildRequires: golang(github.com/boltdb/bolt) +BuildRequires: golang(go.etcd.io/bbolt) +BuildRequires: golang(github.com/bmatcuk/doublestar/v4) BuildRequires: golang(github.com/coreos/go-systemd/activation) -BuildRequires: golang(github.com/godbus/dbus) -BuildRequires: golang(github.com/godbus/dbus/introspect) +BuildRequires: golang(github.com/godbus/dbus/v5) +BuildRequires: golang(github.com/godbus/dbus/v5/introspect) BuildRequires: golang(github.com/gorilla/mux) BuildRequires: golang(github.com/jessevdk/go-flags) BuildRequires: golang(github.com/juju/ratelimit) @@ -158,6 +164,7 @@ BuildRequires: golang(gopkg.in/tomb.v2) BuildRequires: golang(gopkg.in/yaml.v2) BuildRequires: golang(gopkg.in/yaml.v3) %endif +BuildRequires: go-rpm-macros %description Snappy is a modern, cross-distribution, transactional package manager @@ -165,7 +172,7 @@ designed for working with self-contained, immutable packages. %package -n snap-confine Summary: Confinement system for snap applications -License: GPLv3 +License: GPL-3.0-only BuildRequires: autoconf BuildRequires: autoconf-archive BuildRequires: automake @@ -204,7 +211,7 @@ the started snap applications. %package selinux Summary: SELinux module for snapd -License: GPLv2+ +License: GPL-2.0-or-later BuildArch: noarch BuildRequires: selinux-policy BuildRequires: selinux-policy-devel @@ -225,18 +232,21 @@ BuildArch: noarch %endif %if ! 0%{?with_bundled} -Requires: golang(github.com/boltdb/bolt) +Requires: golang(github.com/bmatcuk/doublestar/v4) Requires: golang(github.com/coreos/go-systemd/activation) -Requires: golang(github.com/godbus/dbus) -Requires: golang(github.com/godbus/dbus/introspect) +Requires: golang(github.com/godbus/dbus/v5) +Requires: golang(github.com/godbus/dbus/v5/introspect) Requires: golang(github.com/gorilla/mux) Requires: golang(github.com/jessevdk/go-flags) Requires: golang(github.com/juju/ratelimit) Requires: golang(github.com/kr/pretty) Requires: golang(github.com/kr/text) +Requires: golang(github.com/mattn/go-runewidth) Requires: golang(github.com/mvo5/goconfigparser) +Requires: golang(github.com/rivo/uniseg) Requires: golang(github.com/seccomp/libseccomp-golang) Requires: golang(github.com/snapcore/go-gettext) +Requires: golang(go.etcd.io/bbolt) Requires: golang(golang.org/x/crypto/openpgp/armor) Requires: golang(golang.org/x/crypto/openpgp/packet) Requires: golang(golang.org/x/crypto/sha3) @@ -253,19 +263,21 @@ Requires: golang(gopkg.in/yaml.v3) %else # These Provides are unversioned because the sources in # the bundled tarball are unversioned (they go by git commit) -# *sigh*... I hate golang... -Provides: bundled(golang(github.com/snapcore/bolt)) +Provides: bundled(golang(github.com/bmatcuk/doublestar/v4)) Provides: bundled(golang(github.com/coreos/go-systemd/activation)) -Provides: bundled(golang(github.com/godbus/dbus)) -Provides: bundled(golang(github.com/godbus/dbus/introspect)) +Provides: bundled(golang(github.com/godbus/dbus/v5)) +Provides: bundled(golang(github.com/godbus/dbus/v5/introspect)) Provides: bundled(golang(github.com/gorilla/mux)) Provides: bundled(golang(github.com/jessevdk/go-flags)) Provides: bundled(golang(github.com/juju/ratelimit)) Provides: bundled(golang(github.com/kr/pretty)) Provides: bundled(golang(github.com/kr/text)) +Provides: bundled(golang(github.com/mattn/go-runewidth)) Provides: bundled(golang(github.com/mvo5/goconfigparser)) +Provides: bundled(golang(github.com/rivo/uniseg)) Provides: bundled(golang(github.com/seccomp/libseccomp-golang)) Provides: bundled(golang(github.com/snapcore/go-gettext)) +Provides: bundled(golang(go.etcd.io/bbolt)) Provides: bundled(golang(golang.org/x/crypto/openpgp/armor)) Provides: bundled(golang(golang.org/x/crypto/openpgp/packet)) Provides: bundled(golang(golang.org/x/crypto/sha3)) @@ -473,18 +485,21 @@ providing packages with %{import_path} prefix. %if ! 0%{?with_bundled} %setup -q # Ensure there's no bundled stuff accidentally leaking in... -rm -rf vendor/* +rm -rf vendor c-vendor %else # Extract each tarball properly %setup -q -D -b 1 %endif # Apply patches %autopatch -p1 +# systemd on EL8 does not recognize RestartMode +# https://bugzilla.redhat.com/show_bug.cgi?id=2315759 +%if 0%{?el8} +sed -i -e '/^RestartMode=/d' data/systemd/snapd.service.in +%endif %build -# We don't want/need squashfuse in the rpm, as it's available in Fedora and EPEL -sed -e 's:_ "github.com/snapcore/squashfuse"::g' -i systemd/systemd.go # Build snapd mkdir -p src/github.com/snapcore @@ -494,51 +509,95 @@ export GOPATH=$(pwd):%{gopath} # FIXME: move spec file really to a go.mod world instead of this hack rm -f go.mod export GO111MODULE=off +# Ensure we do not pass -mod=foo argument to go, as we disable modules and go +# does not allow us to do both. +sed -e 's/-mod=readonly//g' -e 's/-mod=vendor//g' packaging/snapd2.mk # Generate version files -./mkversion.sh "%{version}-%{release}" +cat <snapdtool/version_generated.go +package snapdtool -# see https://github.com/gofed/go-macros/blob/master/rpm/macros.d/macros.go-compilers-golang -BUILDTAGS= -%if 0%{?with_test_keys} -BUILDTAGS="withtestkeys nosecboot" -%else -BUILDTAGS="nosecboot" -%endif +func init() { + Version = "%{version}-%{release}" +} +EOF + +cat <cmd/VERSION +%{version}-%{release} +EOF + +cat <data/info +VERSION=%{version}-%{release} +SNAPD_APPARMOR_REEXEC=0 +SNAPD_ASSERTS_FORMATS='{"account-key":1,"snap-declaration":6,"system-user":2}' +EOF %if ! 0%{?with_bundled} # We don't need the snapcore fork for bolt - it is just a fix on ppc sed -e "s:github.com/snapcore/bolt:github.com/boltdb/bolt:g" -i advisor/*.go %endif -# We have to build snapd first to prevent the build from -# building various things from the tree without additional -# set tags. -%gobuild -o bin/snapd $GOFLAGS %{import_path}/cmd/snapd -BUILDTAGS="${BUILDTAGS} nomanagers" -%gobuild -o bin/snap $GOFLAGS %{import_path}/cmd/snap -%gobuild -o bin/snap-failure $GOFLAGS %{import_path}/cmd/snap-failure - -# To ensure things work correctly with base snaps, -# snap-exec, snap-update-ns, and snapctl need to be built statically -( %if 0%{?rhel} >= 7 # since RH Developer tools 2018.4 (and later releases), # the go-toolset module is built with FIPS compliance that # defaults to using libcrypto.so which gets loaded at runtime via dlopen(), # disable that functionality for statically built binaries - BUILDTAGS="${BUILDTAGS} no_openssl" + EXTRA_TAGS="${EXTRA_TAGS} no_openssl" %endif - %gobuild_static -o bin/snap-exec $GOFLAGS %{import_path}/cmd/snap-exec - %gobuild_static -o bin/snap-update-ns $GOFLAGS %{import_path}/cmd/snap-update-ns - %gobuild_static -o bin/snapctl $GOFLAGS %{import_path}/cmd/snapctl -) -%if 0%{?rhel} -# There's no static link library for libseccomp in RHEL/CentOS... -sed -e "s/-Bstatic -lseccomp/-Bstatic/g" -i cmd/snap-seccomp/*.go -%endif -%gobuild -o bin/snap-seccomp $GOFLAGS %{import_path}/cmd/snap-seccomp +# Generate snapd.defines.mk, this file is included by snapd.mk. It contains a +# number of variable definitions that are set based on their RPM equivalents. +# Since we can apply any conditional overrides here in the spec file we can +# maintain one consistent set of variables across the spec and makefile worlds. +cat >snapd.defines.mk <<__DEFINES__ +# This file is generated by Fedora's snapd.spec +# Directory variables. +prefix = %{_prefix} +bindir = %{_bindir} +sbindir = %{_sbindir} +libexecdir = %{_libexecdir} +mandir = %{_mandir} +datadir = %{_datadir} +localstatedir = %{_localstatedir} +sharedstatedir = %{_sharedstatedir} +unitdir = %{_unitdir} +builddir = %{_builddir} +# Build configuration +with_core_bits = 0 +with_alt_snap_mount_dir = 1 +with_apparmor = 1 +with_testkeys = %{with_test_keys} +with_vendor = %{with_bundled} +# follow what %%gobuild does +EXTRA_GO_BUILD_FLAGS = -v -x -compiler gc +EXTRA_GO_LDFLAGS = -linkmode external -extldflags '%__global_ldflags' +EXTRA_GO_STATIC_LDFLAGS = -linkmode external -extldflags '%__global_ldflags -static' +EXTRA_GO_BUILD_TAGS = rpm_crashtraceback $EXTRA_TAGS +__DEFINES__ + +# Generate version files + +cat <snapdtool/version_generated.go +package snapdtool + +// generated by snapd.spec; do not edit + +func init() { + Version = "%{version}-%{release}" +} +EOF + +cat <cmd/VERSION +%{version}-%{release} +EOF + +# FIXME: We paste a fixed string but we should run some go code to generate the +# real value. We don't want to do that as that code needs to use host's +# libraries without talking to the proxy. +cat <data/info +SNAPD_APPARMOR_REEXEC=0 +SNAPD_ASSERTS_FORMATS='{"account-key":1,"snap-declaration":6,"system-user":2}' +EOF ( %if 0%{?rhel} == 7 @@ -559,7 +618,6 @@ sed -e "s/-Bstatic -lseccomp/-Bstatic/g" -i cmd/snap-seccomp/*.go # Build snap-confine pushd ./cmd autoreconf --force --install --verbose -# FIXME: add --enable-caps-over-setuid as soon as possible (setuid discouraged!) %configure \ --disable-apparmor \ --enable-selinux \ @@ -575,6 +633,11 @@ autoreconf --force --install --verbose %make_build %{!?with_valgrind:HAVE_VALGRIND=} popd +# Build snap, snapd and other tools +%make_build -f packaging/snapd2.mk \ + SNAPD_DEFINES_DIR=$PWD \ + all + # Build systemd units, dbus services, and env files pushd ./data make BINDIR="%{_bindir}" LIBEXECDIR="%{_libexecdir}" DATADIR="%{_datadir}" \ @@ -602,6 +665,7 @@ install -d -p %{buildroot}%{_sharedstatedir}/snapd/dbus-1/services install -d -p %{buildroot}%{_sharedstatedir}/snapd/dbus-1/system-services install -d -p %{buildroot}%{_sharedstatedir}/snapd/desktop/applications install -d -p %{buildroot}%{_sharedstatedir}/snapd/device +install -d -p %{buildroot}%{_sharedstatedir}/snapd/environment install -d -p %{buildroot}%{_sharedstatedir}/snapd/hostfs install -d -p %{buildroot}%{_sharedstatedir}/snapd/inhibit install -d -p %{buildroot}%{_sharedstatedir}/snapd/lib/gl @@ -618,24 +682,10 @@ install -d -p %{buildroot}%{_datadir}/polkit-1/actions install -d -p %{buildroot}%{_datadir}/selinux/devel/include/contrib install -d -p %{buildroot}%{_datadir}/selinux/packages -# Install snap and snapd -install -p -m 0755 bin/snap %{buildroot}%{_bindir} -install -p -m 0755 bin/snap-exec %{buildroot}%{_libexecdir}/snapd -install -p -m 0755 bin/snap-failure %{buildroot}%{_libexecdir}/snapd -install -p -m 0755 bin/snapd %{buildroot}%{_libexecdir}/snapd -install -p -m 0755 bin/snap-update-ns %{buildroot}%{_libexecdir}/snapd -install -p -m 0755 bin/snap-seccomp %{buildroot}%{_libexecdir}/snapd -# Ensure /usr/bin/snapctl is a symlink to /usr/libexec/snapd/snapctl -install -p -m 0755 bin/snapctl %{buildroot}%{_libexecdir}/snapd/snapctl -ln -sf %{_libexecdir}/snapd/snapctl %{buildroot}%{_bindir}/snapctl - # Install SELinux module install -p -m 0644 data/selinux/snappy.if %{buildroot}%{_datadir}/selinux/devel/include/contrib install -p -m 0644 data/selinux/snappy.pp.bz2 %{buildroot}%{_datadir}/selinux/packages -# Install snap(8) man page -bin/snap help --man > %{buildroot}%{_mandir}/man8/snap.8 - # Install the "info" data file with snapd version install -m 644 -D data/info %{buildroot}%{_libexecdir}/snapd/info @@ -654,8 +704,6 @@ pushd ./cmd chmod 0755 %{buildroot}%{_sharedstatedir}/snapd/void # We don't use AppArmor rm -rfv %{buildroot}%{_sysconfdir}/apparmor.d -# ubuntu-core-launcher is dead -rm -fv %{buildroot}%{_bindir}/ubuntu-core-launcher popd # Install all systemd and dbus units, and env files @@ -666,9 +714,12 @@ pushd ./data SNAP_MOUNT_DIR="%{_sharedstatedir}/snapd/snap" \ SNAPD_ENVIRONMENT_FILE="%{_sysconfdir}/sysconfig/snapd" popd -# Sudo tweaks do not work anyway, see -# https://bugzilla.redhat.com/show_bug.cgi?id=1691996 for more details -rm -rfv %{buildroot}%{_sysconfdir}/sudoers.d + +# Install snap, snapd and tools +# auto-remove unnecessary files and service units +%make_install -f packaging/snapd2.mk \ + SNAPD_DEFINES_DIR=$PWD \ + install %if 0%{?rhel} == 7 # Install kernel tweaks @@ -677,24 +728,19 @@ install -m 644 -D data/sysctl/rhel7-snap.conf %{buildroot}%{_sysctldir}/99-snap. %endif # Remove snappy core specific units -rm -fv %{buildroot}%{_unitdir}/snapd.system-shutdown.service -rm -fv %{buildroot}%{_unitdir}/snapd.snap-repair.* -rm -fv %{buildroot}%{_unitdir}/snapd.core-fixup.* -rm -fv %{buildroot}%{_unitdir}/snapd.recovery-chooser-trigger.service +rm -fv %{buildroot}%{_unitdir}/snapd.failure.service -# Remove snappy core specific scripts and binaries -rm %{buildroot}%{_libexecdir}/snapd/snapd.core-fixup.sh -rm %{buildroot}%{_libexecdir}/snapd/system-shutdown - -# Remove snapd apparmor service -rm -f %{buildroot}%{_unitdir}/snapd.apparmor.service -rm -f %{buildroot}%{_libexecdir}/snapd/snapd-apparmor - -# Install Polkit configuration -install -m 644 -D data/polkit/io.snapcraft.snapd.policy %{buildroot}%{_datadir}/polkit-1/actions +# Remove gpio-chardev ordering target +rm -f %{buildroot}%{_unitdir}/snapd.gpio-chardev-setup.target # Disable re-exec by default -echo 'SNAP_REEXEC=0' > %{buildroot}%{_sysconfdir}/sysconfig/snapd +mkdir -p %{buildroot}%{_sysconfdir}/sysconfig +cat <<'EOF' > %{buildroot}%{_sysconfdir}/sysconfig/snapd +# Snapd daemon can reexec into the binary from the snapd snap, if +# it is newer than the version installed through distro packaging. +# Set to 1 to enable reexec. The default is 0. +#SNAP_REEXEC=0 +EOF # Create state.json and the README file to be ghosted touch %{buildroot}%{_sharedstatedir}/snapd/state.json @@ -736,25 +782,20 @@ sort -u -o devel.file-list devel.file-list %check for binary in snap-exec snap-update-ns snapctl; do - ldd bin/$binary 2>&1 | grep 'not a dynamic executable' + ldd %{_builddir}/$binary 2>&1 | grep 'not a dynamic executable' done # snapd tests %if 0%{?with_check} && 0%{?with_unit_test} && 0%{?with_devel} -%if ! 0%{?with_bundled} -export GOPATH=%{buildroot}/%{gopath}:%{gopath} -%else -export GOPATH=%{buildroot}/%{gopath}:$(pwd)/Godeps/_workspace:%{gopath} -%endif -# FIXME: we are in the go.mod world now but without this things fall apart -export GO111MODULE=off -%gotest %{import_path}/... +%make_build -f packaging/snapd2.mk \ + SNAPD_DEFINES_DIR=$PWD \ + check %endif # snap-confine tests (these always run!) -pushd ./cmd -make check -popd +make -C cmd -k check +# and data files +make -C data -k check %files #define license tag if not already defined @@ -771,9 +812,9 @@ popd %{_libexecdir}/snapd/snapctl %{_libexecdir}/snapd/snapd %{_libexecdir}/snapd/snap-exec -%{_libexecdir}/snapd/snap-failure %{_libexecdir}/snapd/info %{_libexecdir}/snapd/snap-mgmt +%{_libexecdir}/snapd/snapd-apparmor %{_libexecdir}/snapd/snap-mgmt-selinux %{_mandir}/man8/snap.8* %{_datadir}/applications/snap-handle-link.desktop @@ -787,9 +828,8 @@ popd %{_systemd_system_env_generator_dir}/snapd-env-generator %{_unitdir}/snapd.socket %{_unitdir}/snapd.service -%{_unitdir}/snapd.autoimport.service -%{_unitdir}/snapd.failure.service %{_unitdir}/snapd.seeded.service +%{_unitdir}/snapd.apparmor.service %{_unitdir}/snapd.mounts.target %{_unitdir}/snapd.mounts-pre.target %{_userunitdir}/snapd.session-agent.service @@ -809,6 +849,7 @@ popd %dir %{_sharedstatedir}/snapd %dir %{_sharedstatedir}/snapd/assertions %dir %{_sharedstatedir}/snapd/cookie +%dir %{_sharedstatedir}/snapd/cgroup %dir %{_sharedstatedir}/snapd/dbus-1 %dir %{_sharedstatedir}/snapd/dbus-1/services %dir %{_sharedstatedir}/snapd/dbus-1/system-services @@ -825,13 +866,19 @@ popd %dir %{_sharedstatedir}/snapd/mount %dir %{_sharedstatedir}/snapd/seccomp %dir %{_sharedstatedir}/snapd/seccomp/bpf +%ghost %{_sharedstatedir}/snapd/seccomp/bpf/global.bin %dir %{_sharedstatedir}/snapd/snaps %dir %{_sharedstatedir}/snapd/snap %ghost %dir %{_sharedstatedir}/snapd/snap/bin -%dir %{_localstatedir}/cache/snapd -%dir %{_localstatedir}/snap %ghost %{_sharedstatedir}/snapd/state.json +%ghost %{_sharedstatedir}/snapd/system-key +%ghost %{_sharedstatedir}/snapd/snap/bin %ghost %{_sharedstatedir}/snapd/snap/README +%dir %{_localstatedir}/cache/snapd +%ghost %{_localstatedir}/cache/snapd/commands +%ghost %{_localstatedir}/cache/snapd/names +%ghost %{_localstatedir}/cache/snapd/sections +%dir %{_localstatedir}/snap # this is typically owned by zsh, but we do not want to explicitly require zsh %dir %{_datadir}/zsh %dir %{_datadir}/zsh/site-functions @@ -842,9 +889,9 @@ popd %doc cmd/snap-confine/PORTING %license COPYING %dir %{_libexecdir}/snapd -# For now, we can't use caps -# FIXME: Switch to "%%attr(0755,root,root) %%caps(cap_sys_admin=pe)" asap! -%attr(4755,root,root) %{_libexecdir}/snapd/snap-confine +%caps(%{snap_confine_caps}) %{_libexecdir}/snapd/snap-confine +%{_libexecdir}/snapd/snap-confine.caps +%{_libexecdir}/snapd/snap-confine.v2-only.caps %{_libexecdir}/snapd/snap-device-helper %{_libexecdir}/snapd/snap-discard-ns %{_libexecdir}/snapd/snap-gdb-shim @@ -943,8 +990,1204 @@ if [ $1 -eq 0 ]; then %selinux_relabel_post fi - %changelog +* Thu Nov 13 2025 Ernest Lotter +- New upstream release 2.72 + - FDE: support replacing TPM protected keys at runtime via the + /v2/system-volumes endpoint + - FDE: support secboot preinstall check fix actions for 25.10+ + hybrid installs via the /v2/system/{label} endpoint + - FDE: tweak polkit message to remove jargon + - FDE: ensure proper sealing with kernel command line defaults + - FDE: provide generic reseal function + - FDE: support using OPTEE for protecting keys, as an alternative to + existing fde-setup hooks (Ubuntu Core only) + - Confdb: 'snapctl get --view' supports passing default values + - Confdb: content sub-rules in confdb-schemas inherit their parent + rule's "access" + - Confdb: make confdb error kinds used in API more generic + - Confdb: fully support lists and indexed paths (including unset) + - Prompting: add notice backend for prompting types (unused for now) + - Prompting: include request cgroup in prompt + - Prompting: handle unsupported xattrs + - Prompting: add permission mapping for the camera interface + - Notices: read notices from state without state lock + - Notices: add methods to get notice fields and create, reoccur, and + deepcopy notice + - Notices: add notice manager to coordinate separate notice backends + - Notices: support draining notices from state when notice backend + registered as producer of a particular notice type + - Notices: query notice manager from daemon instead of querying + state for notices directly + - Packaging: Ubuntu | ignore .git directory + - Packaging: FIPS | bump deb Go FIPS to 1.23 + - Packaging: snap | bump FIPS toolchain to 1.23 + - Packaging: debian | sync most upstream changes + - Packaging: debian-sid | depends on libcap2-bin for postint + - Packaging: Fedora | drop fakeroot + - Packaging: snap | modify snapd.mk to pass build tags when running + unit tests + - Packaging: snap | modify snapd.mk to pass nooptee build tag + - Packaging: modify Makefile.am to fix snap-confine install profile + with 'make hack' + - Packaging: modify Makefile.am to fix out-of-tree use of 'make + hack' + - LP: #2122054 Snap installation: skip snap icon download when + running in a cloud or using a proxy store + - Snap installation: add timeout to http client when downloading + snap icon + - Snap installation: use http(s) proxy for icon downloads + - LP: #2117558 snap-confine: fix error message with /root/snap not + accessible + - snap-confine: fix non-suid limitation by switching to root:root to + operate v1 freezer + - core-initrd: do not use writable-paths when not available + - core-initrd: remove debian folder + - LP: #1916244 Interfaces: gpio-chardev | re-enable the gpio-chardev + interface now with the more robust gpio-aggregator configfs kernel + interface + - Interfaces: gpio-chardev | exclusive snap connections, raise a + conflict when both gpio-chardev and gpio are connected + - Interfaces: gpio-chardev | fix gpio-aggregator module load order + - Interfaces: ros-snapd-support | grant access to /v2/changes + - Interfaces: uda-driver-libs, egl-driver-libs, gbm-driver-libs, + opengl-driver-libs, opengles-driver-libs | new interfaces to + support nvidia driver components + - Interfaces: microstack-support | allow DPDK (hugepage related + permissions) + - Interfaces: system-observe | allow reading additional files in + /proc, needed by node-exporter + - Interfaces: u2f | add Cano Key, Thesis FIDO2 BioFP+ Security Key + and Kensington VeriMark DT Fingerprint Key to device list + - Interfaces: snap-interfaces-requests-control | allow shell API + control + - Interfaces: fwupd | allow access to Intel CVS sysfs + - Interfaces: hardware-observe | allow read access to Kernel + Samepage Merging (KSM) + - Interfaces: xilinx-dma | support Multi Queue DMA (QDMA) IP + - Interfaces: spi | relax sysfs permission rules to allow access to + SPI device node attributes + - Interfaces: content | introduce compatibility label + - LP: #2121238 Interfaces: do not expose Kerberos tickets for + classic snaps + - Interfaces: ssh-public-keys | allow ro access to public host keys + with ssh-key + - Interfaces: Modify AppArmor template to allow listing systemd + credentials and invoking systemd-creds + - Interfaces: modify AppArmor template with workarounds for Go 1.35 + cgroup aware GOMAXPROCS + - Interfaces: modify seccomp template to allow landlock_* + - Prevent snap hooks from running while relevant snaps are unlinked + - Make refreshes wait before unlinking snaps if running hooks can be + affected + - Fix systemd unit generation by moving "WantedBy=" from section + "unit" to "install" + - Add opt-in logging support for snap-update-ns + - Unhide 'snap help' sign and export-key under Development category + - LP: #2117121 Cleanly support socket activation for classic snap + - Add architecture to 'snap version' output + - Add 'snap debug api' option to disable authentication through + auth.json + - Show grade in notes for 'snap info --verbose' + - Fix preseeding failure due to scan-disk issue on RPi + - Support 'snap debug api' queries to user session agents + - LP: #2112626 Improve progress reporting for snap install/refresh + - Drop legacy BAMF_DESKTOP_FILE_HINT in desktop files + - Fix /v2/apps error for root user when user services are present + - LP: #2114704 Extend output to indicate when snap data snapshot was + created during remove + - Improve how we handle emmc volumes + - Improve handling of system-user extra assertions + +* Fri Oct 10 2025 Alejandro Sáez - 2.71-1 +- rebuild + +* Fri Aug 22 2025 Ernest Lotter +- New upstream release 2.71 + - FDE: auto-repair when recovery key is used + - FDE: revoke keys on shim update + - FDE: revoke old TPM keys when dbx has been updated + - FDE: do not reseal FDE hook keys every time + - FDE: store keys in the kernel keyring when installing from initrd + - FDE: allow disabled DMA on Core + - FDE: snap-bootstrap: do not check for partition in scan-disk on + CVM + - FDE: support secboot preinstall check for 25.10+ hybrid installs + via the /v2/system/{label} endpoint + - FDE: support generating recovery key at install time via the + /v2/systems/{label} endpoint + - FDE: update passphrase quality check at install time via the + /v2/systems/{label} endpoint + - FDE: support replacing recovery key at runtime via the new + /v2/system-volumes endpoint + - FDE: support checking recovery keys at runtime via the /v2/system- + volumes endpoint + - FDE: support enumerating keyslots at runtime via the /v2/system- + volumes endpoint + - FDE: support changing passphrase at runtime via the /v2/system- + volumes endpoint + - FDE: support passphrase quality check at runtime via the + /v2/system-volumes endpoint + - FDE: update secboot to revision 3e181c8edf0f + - Confdb: support lists and indexed paths on read and write + - Confdb: alias references must be wrapped in brackets + - Confdb: support indexed paths in confdb-schema assertion + - Confdb: make API errors consistent with options + - Confdb: fetch confdb-schema assertion on access + - Confdb: prevent --previous from being used in read-side hooks + - Components: fix snap command with multiple components + - Components: set revision of seed components to x1 + - Components: unmount extra kernel-modules components mounts + - AppArmor Prompting: add lifespan "session" for prompting rules + - AppArmor Prompting: support restoring prompts after snapd restart + - AppArmor Prompting: limit the extra information included in probed + AppArmor features and system key + - Notices: refactor notice state internals + - SELinux: look for restorecon/matchpathcon at all known locations + rather than current PATH + - SELinux: update policy to allow watching cgroups (for RAA), and + talking to user session agents (service mgmt/refresh) + - Refresh App Awareness: Fix unexpected inotify file descriptor + cleanup + - snap-confine: workaround for glibc fchmodat() fallback and handle + ENOSYS + - snap-confine: add support for host policy for limiting users able + to run snaps + - LP: #2114923 Reject system key mismatch advise when not yet seeded + - Use separate lanes for essential and non-essential snaps during + seeding and allow non-essential installs to retry + - Fix bug preventing remodel from core18 to core18 when snapd snap + is unchanged + - LP: #2112551 Make removal of last active revision of a snap equal + to snap remove + - LP: #2114779 Allow non-gpt in fallback mode to support RPi + - Switch from using systemd LogNamespace to manually controlled + journal quotas + - Change snap command trace logging to only log the command names + - Grant desktop-launch access to /v2/snaps + - Update code for creating the snap journal stream + - Switch from using core to snapd snap for snap debug connectivity + - LP: #2112544 Fix offline remodel case where we switched to a + channel without an actual refresh + - LP: #2112332 Exclude snap/snapd/preseeding when generating preseed + tarball + - LP: #1952500 Fix snap command progress reporting + - LP: #1849346 Interfaces: kerberos-tickets | add new interface + - Interfaces: u2f | add support for Thetis Pro + - Interfaces: u2f | add OneSpan device and fix older device + - Interfaces: pipewire, audio-playback | support pipewire as system + daemon + - Interfaces: gpg-keys | allow access to GPG agent sockets + - Interfaces: usb-gadget | add new interface + - Interfaces: snap-fde-control, firmware-updater-support | add new + interfaces to support FDE + - Interfaces: timezone-control | extend to support timedatectl + varlink + - Interfaces: cpu-control | fix rules for accessing IRQ sysfs and + procfs directories + - Interfaces: microstack-support | allow SR-IOV attachments + - Interfaces: modify AppArmor template to allow snaps to read their + own systemd credentials + - Interfaces: posix-mq | allow stat on /dev/mqueue + - LP: #2098780 Interfaces: log-observe | add capability + dac_read_search + - Interfaces: block-devices | allow access to ZFS pools and datasets + - LP: #2033883 Interfaces: block-devices | opt-in access to + individual partitions + - Interfaces: accel | add new interface to support accel kernel + subsystem + - Interfaces: shutdown | allow client to bind on its side of dbus + socket + - Interfaces: modify seccomp template to allow pwritev2 + - Interfaces: modify AppArmor template to allow reading + /proc/sys/fs/nr_open + - Packaging: drop snap.failure service for openSUSE + - Packaging: add SELinux support for openSUSE + - Packaging: disable optee when using nooptee build tag + - Packaging: add support for static PIE builds in snapd.mk, drop + pie.patch from openSUSE + - Packaging: add libcap2-bin runtime dependency for ubuntu-16.04 + - Packaging: use snapd.mk for packaging on Fedora + - Packaging: exclude .git directory + - Packaging: fix DPKG_PARSECHANGELOG assignment + - Packaging: fix building on Fedora with dpkg installed + +* Fri Aug 15 2025 Maxwell G - 2.70-3 +- Rebuild for golang-1.25.0 + +* Fri Jul 25 2025 Fedora Release Engineering - 2.70-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + +* Tue Jun 03 2025 Ernest Lotter +- New upstream release 2.70 + - FDE: Fix reseal with v1 hook key format + - FDE: set role in TPM keys + - AppArmor prompting (experimental): add handling for expired + requests or listener in the kernel + - AppArmor prompting: log the notification protocol version + negotiated with the kernel + - AppArmor prompting: implement notification protocol v5 (manually + disabled for now) + - AppArmor prompting: register listener ID with the kernel and + resend notifications after snapd restart (requires protocol v5+) + - AppArmor prompting: select interface from metadata tags and set + request interface accordingly (requires protocol v5+) + - AppArmor prompting: include request PID in prompt + - AppArmor prompting: move the max prompt ID file to a subdirectory + of the snap run directory + - AppArmor prompting: avoid race between closing/reading socket fd + - Confdb (experimental): make save/load hooks mandatory if affecting + ephemeral + - Confdb: clear tx state on failed load + - Confdb: modify 'snap sign' formats JSON in assertion bodies (e.g. + confdb-schema) + - Confdb: add NestedEphemeral to confdb schemas + - Confdb: add early concurrency checks + - Simplify building Arch package + - Enable snapd.apparmor on Fedora + - Build snapd snap with libselinux + - Emit snapd.apparmor warning only when using apparmor backend + - When running snap, on system key mismatch e.g. due to network + attached HOME, trigger and wait for a security profiles + regeneration + - Avoid requiring state lock to get user, warnings, or pending + restarts when handling API requests + - Start/stop ssh.socket for core24+ when enabling/disabling the ssh + service + - Allow providing a different base when overriding snap + - Modify snap-bootstrap to mount snapd snap directly to /snap + - Modify snap-bootstrap to mount /lib/{modules,firmware} from snap + as fallback + - Modify core-initrd to use systemctl reboot instead of /sbin/reboot + - Copy the initramfs 'manifest-initramfs.yaml' to initramfs file + creation directory so it can be copied to the kernel snap + - Build the early initrd from installed ucode packages + - Create drivers tree when remodeling from UC20/22 to UC24 + - Load gpio-aggregator module before the helper-service needs it + - Run 'systemctl start' for mount units to ensure they are run also + when unchanged + - Update godbus version to 'v5 v5.1.0' + - Add support for POST to /v2/system-info with system-key-mismatch + indication from the client + - Add 'snap sign --update-timestamp' flag to update timestamp before + signing + - Add vfs support for snap-update-ns to use to simulate and evaluate + mount sequences + - Add refresh app awareness debug logging + - Add snap-bootstrap scan-disk subcommand to be called from udev + - Add feature to inject proxy store assertions in build image + - Add OP-TEE bindings, enable by default in ARM and ARM64 builds + - Fix systemd dependency options target to go under 'unit' section + - Fix snap-bootstrap reading kernel snap instead of base resulting + in bad modeenv + - Fix a regression during seeding when using early-config + - LP: #2107443 reset SHELL to /bin/bash in non-classic snaps + - Make Azure kernels reboot upon panic + - Fix snap-confine to not drop capabilities if the original user is + already root + - Fix data race when stopping services + - Fix task dependency issue by temporarily disable re-refresh on + prerequisite updates + - Fix compiling against op-tee on armhf + - Fix dbx update when not using FDE + - Fix potential validation set deadlock due to bases waiting on + snaps + - LP: #2104066 Only cancel notices requests on stop/shutdown + - Interfaces: bool-file | fix gpio glob pattern as required for + '[XXXX]*' format + - Interfaces: system-packages-doc | allow access to + /usr/local/share/doc + - Interfaces: ros-snapd-support interface | added new interface + - Interfaces: udisks2 | allow chown capability + - Interfaces: system-observe | allow reading cpu.max + - Interfaces: serial-port | add ttyMAXX to allowed list + - Interfaces: modified seccomp template to disallow + 'O_NOTIFICATION_PIPE' + - Interfaces: fwupd | add support for modem-manager plugin + - Interfaces: gpio-chardev | make unsupported and remove + experimental flag to hide this feature until gpio-aggregator is + available + - Interfaces: hardware-random | fix udev match rule + - Interfaces: timeserver-control | extend to allow timedatectl + timesync commands + - Interfaces: add symlinks backend + - Interfaces: system key mismatch handling + +* Tue Apr 08 2025 Ernest Lotter +- New upstream release 2.69 + - FDE: re-factor listing of the disks based on run mode model and + model to correctly resolve paths + - FDE: run snapd from snap-failure with the correct keyring mode + - Snap components: allow remodeling back to an old snap revision + that includes components + - Snap components: fix remodel to a kernel snap that is already + installed on the system, but not the current kernel due to a + previous remodel. + - Snap components: fix for snapctl inputs that can crash snapd + - Confdb (experimental): load ephemeral data when reading data via + snapctl get + - Confdb (experimental): load ephemeral data when reading data via + snap get + - Confdb (experimental): rename {plug}-view-changed hook to observe- + view-{plug} + - Confdb (experimental): rename confdb assertion to confdb-schema + - Confdb (experimental): change operator grouping in confdb-control + assertion + - Confdb (experimental): add confdb-control API + - AppArmor: extend the probed features to include the presence of + files, as well as directories + - AppArmor prompting (experimental): simplify the listener + - AppArmor metadata tagging (disabled): probe parser support for + tags + - AppArmor metadata tagging (disabled): implement notification + protocol v5 + - Confidential VMs: sysroot.mount is now dynamically created by + snap-bootstrap instead of being a static file in the initramfs + - Confidential VMs: Add new implementation of snap integrity API + - Non-suid snap-confine: first phase to replace snap-confine suid + with capabilities to achieve the required permissions + - Initial changes for dynamic security profiles updates + - Provide snap icon fallback for /v2/icons without requiring network + access at runtime + - Add eMMC gadget update support + - Support reexec when using /usr/libexec/snapd on the host (Arch + Linux, openSUSE) + - Auto detect snap mount dir location on unknown distributions + - Modify snap-confine AppArmor template to allow all glibc HWCAPS + subdirectories to prevent launch errors + - LP: #2102456 update secboot to bf2f40ea35c4 and modify snap- + bootstrap to remove usage of go templates to reduce size by 4MB + - Fix snap-bootstrap to mount kernel snap from + /sysroot/writable/system-data + - LP: #2106121 fix snap-bootstrap busy loop + - Fix encoding of time.Time by using omitzero instead of omitempty + (on go 1.24+) + - Fix setting snapd permissions through permctl for openSUSE + - Fix snap struct json tags typo + - Fix snap pack configure hook permissions check incorrect file mode + - Fix gadget snap reinstall to honor existing sizes of partitions + - Fix to update command line when re-executing a snapd tool + - Fix 'snap validate' of specific missing newline and add error on + missed case of 'snap validate --refresh' without another action + - Workaround for snapd-confine time_t size differences between + architectures + - Disallow pack and install of snapd, base and os with specific + configure hooks + - Drop udev build dependency that is no longer required and add + missing systemd-dev dependency + - Build snap-bootstrap with nomanagers tag to decrease size by 1MB + - Interfaces: polkit | support custom polkit rules + - Interfaces: opengl | LP: #2088456 fix GLX on nvidia when xorg is + confined by AppArmor + - Interfaces: log-observe | add missing udev rule + - Interfaces: hostname-control | fix call to hostnamectl in core24 + - Interfaces: network-control | allow removing created network + namespaces + - Interfaces: scsi-generic | re-enable base declaration for scsi- + generic plug + - Interfaces: u2f | add support for Arculus AuthentiKey + +* Wed Apr 02 2025 Ernest Lotter +- New upstream release 2.68.4 + - Snap components: LP: #2104933 workaround for classic 24.04/24.10 + models that incorrectly specify core22 instead of core24 + - Update build dependencies + +* Mon Mar 10 2025 Ernest Lotter +- New upstream release 2.68.3 + - FDE: LP: #2101834 snapd 2.68+ and snap-bootstrap <2.68 fallback to + old keyring path + - Fix Plucky snapd deb build issue related to /var/lib/snapd/void + permissions + - Fix snapd deb build complaint about ifneq with extra bracket + +* Thu Feb 27 2025 Ernest Lotter +- New upstream release 2.68.2 + - FDE: use boot mode for FDE hooks + - FDE: add snap-bootstrap compatibility check to prevent image + creation with incompatible snapd and kernel snap + - FDE: add argon2 out-of-process KDF support + - FDE: have separate mutex for the sections writing a fresh modeenv + - FDE: LP: #2099709 update secboot to e07f4ae48e98 + - Confdb: support pruning ephemeral data and process alternative + types in order + - core-initrd: look at env to mount directly to /sysroot + - core-initrd: prepare for Plucky build and split out 24.10 + (Oracular) + - Fix missing primed packages in snapd snap manifest + - Interfaces: posix-mq | fix incorrect clobbering of global variable + and make interface more precise + - Interfaces: opengl | add more kernel fusion driver files + +* Mon Feb 24 2025 Ernest Lotter +- New upstream release 2.68.1 + - Fix snap-confine type specifier type mismatch on armhf + +* Thu Feb 13 2025 Ernest Lotter +- New upstream release 2.68 + - FDE: add support for new and more extensible key format that is + unified between TPM and FDE hook + - FDE: add support for adding passphrases during installation + - FDE: update secboot to 30317622bbbc + - Snap components: make kernel components available on firstboot + after either initramfs or ephemeral rootfs style install + - Snap components: mount drivers tree from initramfs so kernel + modules are available in early boot stages + - Snap components: support remodeling to models that contain + components + - Snap components: support offline remodeling to models that contain + components + - Snap components: support creating new recovery systems with + components + - Snap components: support downloading components with 'snap + download' command + - Snap components: support sideloading asserted components + - AppArmor Prompting(experimental): improve version checks and + handling of listener notification protocol for communication with + kernel AppArmor + - AppArmor Prompting(experimental): make prompt replies idempotent, + and have at most one rule for any given path pattern, with + potentially mixed outcomes and lifespans + - AppArmor Prompting(experimental): timeout unresolved prompts after + a period of client inactivity + - AppArmor Prompting(experimental): return an error if a patch + request to the API would result in a rule without any permissions + - AppArmor Prompting(experimental): warn if there is no prompting + client present but prompting is enabled, or if a prompting-related + error occurs during snapd startup + - AppArmor Prompting(experimental): do not log error when converting + empty permissions to AppArmor permissions + - Confdb(experimental): rename registries to confdbs (including API + /v2/registries => /v2/confdb) + - Confdb(experimental): support marking confdb schemas as ephemeral + - Confdb(experimental): add confdb-control assertion and feature + flag + - Refresh App Awareness(experimental): LP: #2089195 prevent + possibility of incorrect notification that snap will quit and + update + - Confidential VMs: snap-bootstrap support for loading partition + information from a manifest file for cloudimg-rootfs mode + - Confidential VMs: snap-bootstrap support for setting up cloudimg- + rootfs as an overlayfs with integrity protection + - dm-verity for essential snaps: add support for snap-integrity + assertion + - Interfaces: modify AppArmor template to allow owner read on + @{PROC}/@{pid}/fdinfo/* + - Interfaces: LP: #2072987 modify AppArmor template to allow using + setpriv to run daemon as non-root user + - Interfaces: add configfiles backend that ensures the state of + configuration files in the filesystem + - Interfaces: add ldconfig backend that exposes libraries coming + from snaps to either the rootfs or to other snaps + - Interfaces: LP: #1712808 LP: 1865503 disable udev backend when + inside a container + - Interfaces: add auditd-support interface that grants audit_control + capability and required paths for auditd to function + - Interfaces: add checkbox-support interface that allows + unrestricted access to all devices + - Interfaces: fwupd | allow access to dell bios recovery + - Interfaces: fwupd | allow access to shim and fallback shim + - Interfaces: mount-control | add mount option validator to detect + mount option conflicts early + - Interfaces: cpu-control | add read access to /sys/kernel/irq/ + - Interfaces: locale-control | changed to be implicit on Ubuntu Core + Desktop + - Interfaces: microstack-support | support for utilizing of AMD SEV + capabilities + - Interfaces: u2f | added missing OneSpan device product IDs + - Interfaces: auditd-support | grant seccomp setpriority + - Interfaces: opengl interface | enable parsing of nvidia driver + information files + - Allow mksquashfs 'xattrs' when packing snap types os, core, base + and snapd as part of work to support non-root snap-confine + - Upstream/downstream packaging changes and build updates + - Improve error logs for malformed desktop files to also show which + desktop file is at fault + - Provide more precise error message when overriding channels with + grade during seed creation + - Expose 'snap prepare-image' validation parameter + - Add snap-seccomp 'dump' command that dumps the filter rules from a + compiled profile + - Add fallback release info location /etc/initrd-release + - Added core-initrd to snapd repo and fixed issues with ubuntu-core- + initramfs deb builds + - Remove stale robust-mount-namespace-updates experimental feature + flag + - Remove snapd-snap experimental feature (rejected) and it's feature + flag + - Changed snap-bootstrap to mount base directly on /sysroot + - Mount ubuntu-seed mounted as no-{suid,exec,dev} + - Mapping volumes to disks: add support for volume-assignments in + gadget + - Fix silently broken binaries produced by distro patchelf 0.14.3 by + using locally build patchelf 0.18 + - Fix mismatch between listed refresh candidates and actual refresh + due to outdated validation sets + - Fix 'snap get' to produce compact listing for tty + - Fix missing store-url by keeping it as part of auxiliary store + info + - Fix snap-confine attempting to retrieve device cgroup setup inside + container where it is not available + - Fix 'snap set' and 'snap get' panic on empty strings with early + error checking + - Fix logger debug entries to show correct caller and file + information + - Fix issue preventing hybrid systems from being seeded on first + boot + - LP: #1966203 remove auto-import udev rules not required by deb + package to avoid unwanted syslog errors + - LP: #1886414 fix progress reporting when stdout is on a tty, but + stdin is not + +* Wed Jan 22 2025 Zygmunt Krynicki +- The changelog date and author have been modified to maintain linearity. +- Drop 0001-data-selinux-remove-timedatex.patch - applied upstream. +- New upstream release 2.67 + - AppArmor prompting (experimental): allow overlapping rules + - Registry view (experimental): Changes to registry data (from both + users and snaps) can be validated and saved by custodian snaps + - Registry view (experimental): Support 'snapctl get --pristine' to + read the registry data excluding staged transaction changes + - Registry view (experimental): Put registry commands behind + experimental feature flag + - Components: Make modules shipped/created by kernel-modules + components available right after reboot + - Components: Add tab completion for local component files + - Components: Allow installing snaps and components from local files + jointly on the CLI + - Components: Allow 'snapctl model' command for gadget and kernel + snaps + - Components: Add 'snap components' command + - Components: Bug fixes + - eMMC gadget updates (WIP): add syntax support in gadget.yaml for + eMMC schema + - Support for ephemeral recovery mode on hybrid systems + - Support for dm-verity options in snap-bootstrap + - Support for overlayfs options and allow empty what argument for + tmpfs + - Enable ubuntu-image to determine the size of the disk image to + create + - Expose 'snap debug' commands 'validate-seed' and 'seeding' + - Add debug API option to use dedicated snap socket /run/snapd- + snap.socket + - Hide experimental features that are no longer required + (accepted/rejected) + - Mount ubuntu-save partition with no{exec,dev,suid} at install, run + and factory-reset + - Improve memory controller support with cgroup v2 + - Support ssh socket activation configurations (used by ubuntu + 22.10+) + - Fix generation of AppArmor profile with incorrect revision during + multi snap refresh + - Fix refresh app awareness related deadlock edge case + - Fix not caching delta updated snap download + - Fix passing non root uid, guid to initial tmpfs mount + - Fix ignoring snaps in try mode when amending + - Fix reloading of service activation units to avoid systemd errors + - Fix snapd snap FIPS build on Launchpad to use Advantage Pro FIPS + updates PPA + - Make killing of snap apps best effort to avoid possibility of + malicious failure loop + - Alleviate impact of auto-refresh failure loop with progressive + delay + - Dropped timedatex in selinux-policy to avoid runtime issue + - Fix missing syscalls in seccomp profile + - Modify AppArmor template to allow using SNAP_REEXEC on arch + systems + - Modify AppArmor template to allow using vim.tiny (available in + base snaps) + - Modify AppArmor template to add read-access to debian_version + - Modify AppArmor template to allow owner to read + @{PROC}/@{pid}/sessionid + - {common,personal,system}-files interface: prohibit trailing @ in + filepaths + - {desktop,shutdown,system-observe,upower-observe} interface: + improve for Ubuntu Core Desktop + - custom-device interface: allow @ in custom-device filepaths + - desktop interface: improve launch entry and systray integration + with session + - desktop-legacy interface: allow DBus access to + com.canonical.dbusmenu + - fwupd interface: allow access to nvmem for thunderbolt plugin + - mpris interface: add plasmashell as label + - mount-control interface: add support for nfs mounts + - network-{control,manager} interface: add missing dbus link rules + - network-manager-observe interface: add getDevices methods + - opengl interface: add Kernel Fusion Driver access to opengl + - screen-inhibit-control interface: improve screen inhibit control + for use on core + - udisks2 interface: allow ping of the UDisks2 service + - u2f-devices interface: add Nitrokey Passkey + +* Sun Jan 19 2025 Fedora Release Engineering - 2.66.1-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild + +* Wed Jan 15 2025 Ernest Lotter +- New upstream release 2.67.1 + - Fix apparmor permissions to allow snaps access to kernel modules + and firmware on UC24, which also fixes the kernel-modules-control + interface on UC24 + - AppArmor prompting (experimental): disallow /./ and /../ in path + patterns + - Fix 'snap run' getent based user lookup in case of bad PATH + - Fix snapd using the incorrect AppArmor version during undo of an + refresh for regenerating snap profiles + - Add new syscalls to base templates + - hardware-observe interface: allow riscv_hwprobe syscall + - mount-observe interface: allow listmount and statmount syscalls + +* Tue Dec 03 2024 Orion Poplawski +- Drop RestartMode from snapd.service on EL8 (rhbz#2315759) + +* Fri Nov 29 2024 Zygmunt Krynicki +- Re-cherry pick fix for SELinux timedatex problem from upstream + as it was not released in 2.66.1, sorry. + +* Wed Nov 20 2024 Zygmunt Krynicki +- Drop only patch, applied upstream. + +* Fri Oct 25 2024 Zygmunt Krynicki +- Cherry pick fix for SELinux timedatex problem from upstream + +* Fri Oct 11 2024 Ernest Lotter +- New upstream release 2.66.1 + - AppArmor prompting (experimental): Fix kernel prompting support + check + - Allow kernel snaps to have content slots + - Fix ignoring snaps in try mode when amending + +* Fri Oct 04 2024 Ernest Lotter +- New upstream release 2.66 + - AppArmor prompting (experimental): expand kernel support checks + - AppArmor prompting (experimental): consolidate error messages and + add error kinds + - AppArmor prompting (experimental): grant /v2/snaps/{name} via + snap-interfaces-requests-control + - AppArmor prompting (experimental): add checks for duplicate + pattern variants + - Registry views (experimental): add handlers that commit (and + cleanup) registry transactions + - Registry views (experimental): add a snapctl fail command for + rejecting registry transactions + - Registry views (experimental): allow custodian snaps to implement + registry hooks that modify and save registry data + - Registry views (experimental): run view-changed hooks only for + snaps plugging views affected by modified paths + - Registry views (experimental): make registry transactions + serialisable + - Snap components: handle refreshing components to revisions that + have been on the system before + - Snap components: enable creating Ubuntu Core images that contain + components + - Snap components: handle refreshing components independently of + snaps + - Snap components: handle removing components when refreshing a snap + that no longer defines them + - Snap components: extend snapd Ubuntu Core installation API to + allow for picking optional snaps and components to install + - Snap components: extend kernel.yaml with "dynamic-modules", + allowing kernel to define a location for kmods from component + hooks + - Snap components: renamed component type "test" to "standard" + - Desktop IDs: support installing desktop files with custom names + based on desktop-file-ids desktop interface plug attr + - Auto-install snapd on classic systems as prerequisite for any non- + essential snap install + - Support loading AppArmor profiles on WSL2 with non-default kernel + and securityfs mounted + - Debian/Fedora packaging updates + - Add snap debug command for investigating execution aspects of the + snap toolchain + - Improve snap pack error for easier parsing + - Add support for user services when refreshing snaps + - Add snap remove --terminate flag for terminating running snap + processes + - Support building FIPS complaint snapd deb and snap + - Fix to not use nss when looking up for users/groups from snapd + snap + - Fix ordering in which layout changes are saved + - Patch snapd snap dynamic linker to ignore LD_LIBRARY_PATH and + related variables + - Fix libexec dir for openSUSE Slowroll + - Fix handling of the shared snap directory for parallel installs + - Allow writing to /run/systemd/journal/dev-log by default + - Avoid state lock during snap removal to avoid delaying other snapd + operations + - Add nomad-support interface to enable running Hashicorp Nomad + - Add intel-qat interface + - u2f-devices interface: add u2f trustkey t120 product id and fx + series fido u2f devices + - desktop interface: improve integration with xdg-desktop-portal + - desktop interface: add desktop-file-ids plug attr to desktop + interface + - unity7 interface: support desktop-file-ids in desktop files rule + generation + - desktop-legacy interface: support desktop-file-ids in desktop + files rule generation + - desktop-legacy interface: grant access to gcin socket location + - login-session-observe interface: allow introspection + - custom-device interface: allow to explicitly identify matching + device in udev tagging block + - system-packages-doc interface: allow reading /usr/share/javascript + - modem-manager interface: add new format of WWAN ports + - pcscd interface: allow pcscd to read opensc.conf + - cpu-control interface: add IRQ affinity control to cpu_control + - opengl interface: add support for cuda workloads on Tegra iGPU in + opengl interface + +* Thu Sep 12 2024 Ernest Lotter +- New upstream release 2.65.3 + - Fix missing aux info from store on snap setup + +* Fri Sep 06 2024 Ernest Lotter +- New upstream release 2.65.2 + - Bump squashfuse from version 0.5.0 to 0.5.2 (used in snapd deb + only) + +* Sat Aug 24 2024 Ernest Lotter +- New upstream release 2.65.1 + - Support building snapd using base Core22 (Snapcraft 8.x) + - FIPS: support building FIPS complaint snapd variant that switches + to FIPS mode when the system boots with FIPS enabled + - AppArmor: update to latest 4.0.2 release + - AppArmor: enable using ABI 4.0 from host parser + - AppArmor: fix parser lookup + - AppArmor: support AppArmor snippet priorities + - AppArmor: allow reading cgroup memory.max file + - AppArmor: allow using snap-exec coming from the snapd snap when + starting a confined process with jailmode + - AppArmor prompting (experimental): add checks for prompting + support, include prompting status in system key, and restart snapd + if prompting flag changes + - AppArmor prompting (experimental): include prompt prefix in + AppArmor rules if prompting is supported and enabled + - AppArmor prompting (experimental): add common types, constraints, + and mappings from AppArmor permissions to abstract permissions + - AppArmor prompting (experimental): add path pattern parsing and + matching + - AppArmor prompting (experimental): add path pattern precedence + based on specificity + - AppArmor prompting (experimental): add packages to manage + outstanding request prompts and rules + - AppArmor prompting (experimental): add prompting API and notice + types, which require snap-interfaces-requests-control interface + - AppArmor prompting (experimental): feature flag can only be + enabled if prompting is supported, handler service connected, and + the service can be started + - Registry views (experimental): rename from aspects to registries + - Registry views (experimental): support reading registry views and + setting/unsetting registry data using snapctl + - Registry views (experimental): fetch and refresh registry + assertions as needed + - Registry views (experimental): restrict view paths from using a + number as first character and view names to storage path style + patterns + - Snap components: support installing snaps and components from + files at the same time (no REST API/CLI) + - Snap components: support downloading components related assertions + from the store + - Snap components: support installing components from the store + - Snap components: support removing components individually and + during snap removal + - Snap components: support kernel modules as components + - Snap components: support for component install, pre-refresh and + post-refresh hooks + - Snap components: initial support for building systems that contain + components + - Refresh app awareness (experimental): add data field for + /v2/changes REST API to allow associating each task with affected + snaps + - Refresh app awareness (experimental): use the app name from + .desktop file in notifications + - Refresh app awareness (experimental): give snap-refresh-observe + interface access to /v2/snaps/{name} endpoint + - Improve snap-confine compatibility with nvidia drivers + - Allow re-exec when SNAP_REEXEC is set for unlisted distros to + simplify testing + - Allow mixing revision and channel on snap install + - Generate GNU build ID for Go binaries + - Add missing etelpmoc.sh for shell completion + - Do not attempt to run snapd on classic when re-exec is disabled + - Packaging/build maintenance for Debian sid, Fedora, Arch, openSuse + - Add snap debug API command to enable running raw queries + - Enable snap-confine snap mount directory detection + - Replace global seccomp filter with deny rules in standard seccomp + template + - Remove support for Ubuntu Core Launcher (superseded by snap- + confine) + - Support creating pending serial bound users after serial assertion + becomes available + - Support disabling cloud-init using kernel command-line + - In hybrid systems, apps can refresh without waiting for restarts + required by essential snaps + - Ship snap-debug-info.sh script used for system diagnostics + - Improve error messages when attempting to run non-existent snap + - Switch to -u UID:GID for strace-static + - Support enabling snapd logging with snap set system + debug.snapd.{log,log-level} + - Add options system.coredump.enable and system.coredump.maxuse to + support using systemd-coredump on Ubuntu Core + - Provide documentation URL for 'snap interface ' + - Fix snapd riscv64 build + - Fix restarting activated services instead of their activator units + (i.e. sockets, timers) + - Fix potential unexpected auto-refresh of snap on managed schedule + - Fix potential segfault by guarding against kernel command-line + changes on classic system + - Fix proxy entries in /etc/environment with missing newline that + caused later manual entries to not be usable + - Fix offline remodelling by ignoring prerequisites that will + otherwise be downloaded from store + - Fix devmode seccomp deny regression that caused spamming the log + instead of actual denies + - Fix snap lock leak during refresh + - Fix not re-pinning validation sets that were already pinned when + enforcing new validation sets + - Fix handling of unexpected snapd runtime failure + - Fix /v2/notices REST API skipping notices with duplicate + timestamps + - Fix comparing systemd versions that may contain pre-release + suffixes + - Fix udev potentially starting before snap-device-helper is made + available + - Fix race in snap seed metadata loading + - Fix treating cloud-init exit status 2 as error + - Fix to prevent sending refresh complete notification if snap snap- + refresh-observe interface is connected + - Fix to queue snapctl service commands if run from the default- + configure hook to ensure they get up-to-date config values + - Fix stop service failure when the service is not actually running + anymore + - Fix parsing /proc/PID/mounts with spaces + - Add registry interface that provides snaps access to a particular + registry view + - Add snap-interfaces-requests-control interface to enable prompting + client snaps + - steam-support interface: remove all AppArmor and seccomp + restrictions to improve user experience + - opengl interface: improve compatibility with nvidia drivers + - home interface: autoconnect home on Ubuntu Core Desktop + - serial-port interface: support RPMsg tty + - display-control interface: allow changing LVDS backlight power and + brightness + - power-control interface: support for battery charging thesholds, + type/status and AC type/status + - cpu-control interface: allow CPU C-state control + - raw-usb interface: support RPi5 and Thinkpad x13s + - custom-device interface: allow device file locking + - lxd-support interface: allow LXD to self-manage its own cgroup + - network-manager interface: support MPTCP sockets + - network-control interface: allow plug/slot access to gnutls config + and systemd resolved cache flushing via D-Bus + - network-control interface: allow wpa_supplicant dbus api + - gpio-control interface: support gpiochip* devices + - polkit interface: fix "rw" mount option check + - u2f-devices interface: enable additional security keys + - desktop interface: enable kde theming support + +* Fri Aug 23 2024 Ernest Lotter +- New upstream release 2.65 + - Support building snapd using base Core22 (Snapcraft 8.x) + - FIPS: support building FIPS complaint snapd variant that switches + to FIPS mode when the system boots with FIPS enabled + - AppArmor: update to latest 4.0.2 release + - AppArmor: enable using ABI 4.0 from host parser + - AppArmor: fix parser lookup + - AppArmor: support AppArmor snippet priorities + - AppArmor: allow reading cgroup memory.max file + - AppArmor: allow using snap-exec coming from the snapd snap when + starting a confined process with jailmode + - AppArmor prompting (experimental): add checks for prompting + support, include prompting status in system key, and restart snapd + if prompting flag changes + - AppArmor prompting (experimental): include prompt prefix in + AppArmor rules if prompting is supported and enabled + - AppArmor prompting (experimental): add common types, constraints, + and mappings from AppArmor permissions to abstract permissions + - AppArmor prompting (experimental): add path pattern parsing and + matching + - AppArmor prompting (experimental): add path pattern precedence + based on specificity + - AppArmor prompting (experimental): add packages to manage + outstanding request prompts and rules + - AppArmor prompting (experimental): add prompting API and notice + types, which require snap-interfaces-requests-control interface + - AppArmor prompting (experimental): feature flag can only be + enabled if prompting is supported, handler service connected, and + the service can be started + - Registry views (experimental): rename from aspects to registries + - Registry views (experimental): support reading registry views and + setting/unsetting registry data using snapctl + - Registry views (experimental): fetch and refresh registry + assertions as needed + - Registry views (experimental): restrict view paths from using a + number as first character and view names to storage path style + patterns + - Snap components: support installing snaps and components from + files at the same time (no REST API/CLI) + - Snap components: support downloading components related assertions + from the store + - Snap components: support installing components from the store + - Snap components: support removing components individually and + during snap removal + - Snap components: support kernel modules as components + - Snap components: support for component install, pre-refresh and + post-refresh hooks + - Snap components: initial support for building systems that contain + components + - Refresh app awareness (experimental): add data field for + /v2/changes REST API to allow associating each task with affected + snaps + - Refresh app awareness (experimental): use the app name from + .desktop file in notifications + - Refresh app awareness (experimental): give snap-refresh-observe + interface access to /v2/snaps/{name} endpoint + - Improve snap-confine compatibility with nvidia drivers + - Allow re-exec when SNAP_REEXEC is set for unlisted distros to + simplify testing + - Allow mixing revision and channel on snap install + - Generate GNU build ID for Go binaries + - Add missing etelpmoc.sh for shell completion + - Do not attempt to run snapd on classic when re-exec is disabled + - Packaging/build maintenance for Debian sid, Fedora, Arch, openSuse + - Add snap debug API command to enable running raw queries + - Enable snap-confine snap mount directory detection + - Replace global seccomp filter with deny rules in standard seccomp + template + - Remove support for Ubuntu Core Launcher (superseded by snap- + confine) + - Support creating pending serial bound users after serial assertion + becomes available + - Support disabling cloud-init using kernel command-line + - In hybrid systems, apps can refresh without waiting for restarts + required by essential snaps + - Ship snap-debug-info.sh script used for system diagnostics + - Improve error messages when attempting to run non-existent snap + - Switch to -u UID:GID for strace-static + - Support enabling snapd logging with snap set system + debug.snapd.{log,log-level} + - Add options system.coredump.enable and system.coredump.maxuse to + support using systemd-coredump on Ubuntu Core + - Provide documentation URL for 'snap interface ' + - Fix restarting activated services instead of their activator units + (i.e. sockets, timers) + - Fix potential unexpected auto-refresh of snap on managed schedule + - Fix potential segfault by guarding against kernel command-line + changes on classic system + - Fix proxy entries in /etc/environment with missing newline that + caused later manual entries to not be usable + - Fix offline remodelling by ignoring prerequisites that will + otherwise be downloaded from store + - Fix devmode seccomp deny regression that caused spamming the log + instead of actual denies + - Fix snap lock leak during refresh + - Fix not re-pinning validation sets that were already pinned when + enforcing new validation sets + - Fix handling of unexpected snapd runtime failure + - Fix /v2/notices REST API skipping notices with duplicate + timestamps + - Fix comparing systemd versions that may contain pre-release + suffixes + - Fix udev potentially starting before snap-device-helper is made + available + - Fix race in snap seed metadata loading + - Fix treating cloud-init exit status 2 as error + - Fix to prevent sending refresh complete notification if snap snap- + refresh-observe interface is connected + - Fix to queue snapctl service commands if run from the default- + configure hook to ensure they get up-to-date config values + - Fix stop service failure when the service is not actually running + anymore + - Fix parsing /proc/PID/mounts with spaces + - Add registry interface that provides snaps access to a particular + registry view + - Add snap-interfaces-requests-control interface to enable prompting + client snaps + - steam-support interface: remove all AppArmor and seccomp + restrictions to improve user experience + - opengl interface: improve compatibility with nvidia drivers + - home interface: autoconnect home on Ubuntu Core Desktop + - serial-port interface: support RPMsg tty + - display-control interface: allow changing LVDS backlight power and + brightness + - power-control interface: support for battery charging thesholds, + type/status and AC type/status + - cpu-control interface: allow CPU C-state control + - raw-usb interface: support RPi5 and Thinkpad x13s + - custom-device interface: allow device file locking + - lxd-support interface: allow LXD to self-manage its own cgroup + - network-manager interface: support MPTCP sockets + - network-control interface: allow plug/slot access to gnutls config + and systemd resolved cache flushing via D-Bus + - network-control interface: allow wpa_supplicant dbus api + - gpio-control interface: support gpiochip* devices + - polkit interface: fix "rw" mount option check + - u2f-devices interface: enable additional security keys + - desktop interface: enable kde theming support + +* Mon Jul 29 2024 Miroslav Suchý - 2.63-3 +- convert license to SPDX + +* Fri Jul 26 2024 Miroslav Suchý - 2.63-2 +- convert license to SPDX + +* Wed Jul 24 2024 Ernest Lotter +- New upstream release 2.64 + - Support building snapd using base Core22 (Snapcraft 8.x) + - FIPS: support building FIPS complaint snapd variant that switches + to FIPS mode when the system boots with FIPS enabled + - AppArmor: update to AppArmor 4.0.1 + - AppArmor: support AppArmor snippet priorities + - AppArmor prompting: add checks for prompting support, include + prompting status in system key, and restart snapd if prompting + flag changes + - AppArmor prompting: include prompt prefix in AppArmor rules if + prompting is supported and enabled + - AppArmor prompting: add common types, constraints, and mappings + from AppArmor permissions to abstract permissions + - AppArmor prompting: add path pattern parsing and matching + - Registry views (experimental): rename from aspects to registries + - Registry views (experimental): support reading registry views + using snapctl + - Registry views (experimental): restrict view paths from using a + number as first character and view names to storage path style + patterns + - Snap components: support installing snaps and components from + files at the same time (no REST API/CLI) + - Snap components: support downloading components related assertions + from the store + - Snap components: support installing components from the store (no + REST API/CLI) + - Snap components: support removing components (REST API, no CLI) + - Snap components: started support for component hooks + - Snap components: support kernel modules as components + - Refresh app awareness (experimental): add data field for + /v2/changes REST API to allow associating each task with affected + snaps + - Refresh app awareness (experimental): use the app name from + .desktop file in notifications + - Refresh app awareness (experimental): give snap-refresh-observe + interface access to /v2/snaps/{name} endpoint + - Allow re-exec when SNAP_REEXEC is set for unlisted distros to + simplify testing + - Generate GNU build ID for Go binaries + - Add missing etelpmoc.sh for shell completion + - Do not attempt to run snapd on classic when re-exec is disabled + - Packaging/build maintenance for Debian sid, Fedora, Arch, openSuse + - Add snap debug api command to enable running raw queries + - Enable snap-confine snap mount directory detection + - Replace global seccomp filter with deny rules in standard seccomp + template + - Remove support for Ubuntu Core Launcher (superseded by snap- + confine) + - Support creating pending serial bound users after serial assertion + becomes available + - Support disabling cloud-init using kernel command-line + - In hybrid systems, apps can refresh without waiting for restarts + required by essential snaps + - Ship snap-debug-info.sh script used for system diagnostics + - Improve error messages when attempting to run non-existent snap + - Switch to -u UID:GID for strace-static + - Support enabling snapd logging with snap set system + debug.snapd.{log,log-level} + - Fix restarting activated services instead of their activator units + (i.e. sockets, timers) + - Fix potential unexpected auto-refresh of snap on managed schedule + - Fix potential segfault by guarding against kernel command-line + changes on classic system + - Fix proxy entries in /etc/environment with missing newline that + caused later manual entries to not be usable + - Fix offline remodelling by ignoring prerequisites that will + otherwise be downloaded from store + - Fix devmode seccomp deny regression that caused spamming the log + instead of actual denies + - Fix snap lock leak during refresh + - Fix not re-pinning validation sets that were already pinned when + enforcing new validation sets + - Fix handling of unexpected snapd runtime failure + - Fix /v2/notices REST API skipping notices with duplicate + timestamps + - Fix comparing systemd versions that may contain pre-release + suffixes + - Fix udev potentially starting before snap-device-helper is made + available + - Fix race in snap seed metadata loading + - Fix treating cloud-init exit status 2 as error + - Fix to prevent sending refresh complete notification if snap snap- + refresh-observe interface is connected + - Fix to queue snapctl service commands if run from the default- + configure hook to ensure they get up-to-date config values + - Fix stop service failure when the service is not actually running + anymore + - Add registry interface that provides snaps access to a particular + registry view + - steam-support interface: relaxed AppArmor and seccomp restrictions + to improve user experience + - home interface: autoconnect home on Ubuntu Core Desktop + - serial-port interface: support RPMsg tty + - display-control interface: allow changing LVDS backlight power and + brightness + - power-control interface: support for battery charging thesholds, + type/status and AC type/status + - cpu-control interface: allow CPU C-state control + - raw-usb interface: support RPi5 and Thinkpad x13s + - custom-device interface: allow device file locking + - lxd-support interface: allow LXD to self-manage its own cgroup + - network-manager interface: support MPTCP sockets + - network-control interface: allow plug/slot access to gnutls config + and systemd resolved cache flushing via D-Bus + +* Sat Jul 20 2024 Fedora Release Engineering - 2.63-1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + +* Wed Apr 24 2024 Ernest Lotter +- New upstream release 2.63 + - Support for snap services to show the current status of user + services (experimental) + - Refresh app awareness: record snap-run-inhibit notice when + starting app from snap that is busy with refresh (experimental) + - Refresh app awareness: use warnings as fallback for desktop + notifications (experimental) + - Aspect based configuration: make request fields in the aspect- + bundle's rules optional (experimental) + - Aspect based configuration: make map keys conform to the same + format as path sub-keys (experimental) + - Aspect based configuration: make unset and set behaviour similar + to configuration options (experimental) + - Aspect based configuration: limit nesting level for setting value + (experimental) + - Components: use symlinks to point active snap component revisions + - Components: add model assertion support for components + - Components: fix to ensure local component installation always gets + a new revision number + - Add basic support for a CIFS remote filesystem-based home + directory + - Add support for AppArmor profile kill mode to avoid snap-confine + error + - Allow more than one interface to grant access to the same API + endpoint or notice type + - Allow all snapd service's control group processes to send systemd + notifications to prevent warnings flooding the log + - Enable not preseeded single boot install + - Update secboot to handle new sbatlevel + - Fix to not use cgroup for non-strict confined snaps (devmode, + classic) + - Fix two race conditions relating to freedesktop notifications + - Fix missing tunables in snap-update-ns AppArmor template + - Fix rejection of snapd snap udev command line by older host snap- + device-helper + - Rework seccomp allow/deny list + - Clean up files removed by gadgets + - Remove non-viable boot chains to avoid secboot failure + - posix_mq interface: add support for missing time64 mqueue syscalls + mq_timedreceive_time64 and mq_timedsend_time64 + - password-manager-service interface: allow kwalletd version 6 + - kubernetes-support interface: allow SOCK_SEQPACKET sockets + - system-observe interface: allow listing systemd units and their + properties + - opengl interface: enable use of nvidia container toolkit CDI + config generation + * Thu Mar 21 2024 Ernest Lotter - New upstream release 2.62 - Aspects based configuration schema support (experimental) diff --git a/sources b/sources index 869f45e..5ba5479 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (snapd_2.62.no-vendor.tar.xz) = 3fb9fa65e25e7deec7e92def9b60f756cfce35c00b90e5cc370bd641034414313f07c973fcbdef4c58e7a9abc20197316fd51a4a2bf5087088a0593b59104590 -SHA512 (snapd_2.62.only-vendor.tar.xz) = d07a3ba83cad8d25fc03ecb7efc69e8e3f105e41c076bc5b450acf4e98409f11f738b65f542965fac5ccaa56eb9f7b1b36aa06f8b68cd3549b9d2a01b10faa09 +SHA512 (snapd_2.72.no-vendor.tar.xz) = fb556bdb60877a2536cd8e53a7e137935ba27afb5b04efff06d8f858c47cec82a8f1df01fb621f644f0c2abe056a2b0612fabd70ae2d909b2e960692763b8bff +SHA512 (snapd_2.72.only-vendor.tar.xz) = f80b5def82553c044027fbb208fc5d5f76633afe71a8210abc33b48b189fd9347fd1d04bc868c58dc5d0b7fe8c68f6e316edbb6d2a2e060f375a5cdc851c2278