From b38b377fe4241caf203558d3c4350f0873ab35bb Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 22 Jul 2023 02:01:15 +0000 Subject: [PATCH 01/35] Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- snapd.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/snapd.spec b/snapd.spec index 70b3652..7c37a51 100644 --- a/snapd.spec +++ b/snapd.spec @@ -84,7 +84,7 @@ Name: snapd Version: 2.58.3 -Release: 1%{?dist} +Release: 2%{?dist} Summary: A transactional software package manager License: GPLv3 URL: https://%{provider_prefix} @@ -940,6 +940,9 @@ fi %changelog +* Sat Jul 22 2023 Fedora Release Engineering - 2.58.3-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + * Sat Feb 25 2023 Maciek Borzecki - 2.58.3-1 - Releate 2.58.3 to Fedora RHBZ#2173056 From 32ab19879f27c1e6ea03ba583195de364a81fab0 Mon Sep 17 00:00:00 2001 From: Zygmunt Krynicki Date: Wed, 17 Jan 2024 08:26:22 +0100 Subject: [PATCH 02/35] Require xdelta on Fedora or EPEL >= 9 (for delta updates) Signed-off-by: Zygmunt Krynicki --- snapd.spec | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/snapd.spec b/snapd.spec index 7c37a51..8f31038 100644 --- a/snapd.spec +++ b/snapd.spec @@ -84,7 +84,7 @@ Name: snapd Version: 2.58.3 -Release: 2%{?dist} +Release: 3%{?dist} Summary: A transactional software package manager License: GPLv3 URL: https://%{provider_prefix} @@ -112,6 +112,11 @@ Requires: fuse Requires: ((squashfuse and fuse) or kmod(squashfs.ko)) %endif +# Require xdelta for delta updates of snap packages. +%if 0%{?fedora} || ( 0%{?rhel} && 0%{?rhel} > 8 ) +Requires: xdelta +%endif + # bash-completion owns /usr/share/bash-completion/completions Requires: bash-completion @@ -940,6 +945,9 @@ fi %changelog +* Wed Jan 17 2024 Zygmunt Krynicki - 2.58.3-3 +- Require xdelta on Fedora or EPEL >= 9 (for delta updates) + * Sat Jul 22 2023 Fedora Release Engineering - 2.58.3-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild From dc0833090bb5def17947f52fd4055ef68b55c5ce Mon Sep 17 00:00:00 2001 From: Zygmunt Krynicki Date: Wed, 17 Jan 2024 11:26:07 +0100 Subject: [PATCH 03/35] Wait for snapd to seed before installing snaps Currently dist-git tests fail with the following error: + snap list No snaps are installed yet. Try 'snap install hello-world'. + snap install test-snapd-tools error: too early for operation, device not yet seeded or device model not acknowledged It looks like the test ought to wait for snapd to seed to start accepting installation requests. Signed-off-by: Zygmunt Krynicki --- tests/simple.sh | 2 ++ 1 file changed, 2 insertions(+) diff --git a/tests/simple.sh b/tests/simple.sh index ca49be8..fe43306 100755 --- a/tests/simple.sh +++ b/tests/simple.sh @@ -4,6 +4,8 @@ set -ex # snapd should get activated snap list +# wait for snapd to be operational +snap wait system seed.loaded # install a snap snap install test-snapd-tools # run an app from that snap From 9f21c2cdb26fba769033b4f0f37530548acda077 Mon Sep 17 00:00:00 2001 From: Zygmunt Krynicki Date: Wed, 17 Jan 2024 14:15:41 +0100 Subject: [PATCH 04/35] Update to 2.61.1 Re-synchronize changelogs with upstream. Remaining changes are related to Amazon or systems without SE-Linux. Those can be synchronized separately. Signed-off-by: Zygmunt Krynicki --- .gitignore | 2 + snapd.spec | 180 +++++++++++++++++++++++++++++++++++++++++++++++++---- sources | 4 +- 3 files changed, 172 insertions(+), 14 deletions(-) diff --git a/.gitignore b/.gitignore index ccd44c6..99cc85b 100644 --- a/.gitignore +++ b/.gitignore @@ -98,3 +98,5 @@ /snapd_2.57.6.only-vendor.tar.xz /snapd_2.58.3.no-vendor.tar.xz /snapd_2.58.3.only-vendor.tar.xz +/snapd_2.61.1.no-vendor.tar.xz +/snapd_2.61.1.only-vendor.tar.xz diff --git a/snapd.spec b/snapd.spec index 8f31038..af9ab5b 100644 --- a/snapd.spec +++ b/snapd.spec @@ -83,8 +83,8 @@ %{!?_tmpfilesdir: %global _tmpfilesdir %{_prefix}/lib/tmpfiles.d} Name: snapd -Version: 2.58.3 -Release: 3%{?dist} +Version: 2.61.1 +Release: 0%{?dist} Summary: A transactional software package manager License: GPLv3 URL: https://%{provider_prefix} @@ -167,6 +167,7 @@ designed for working with self-contained, immutable packages. Summary: Confinement system for snap applications License: GPLv3 BuildRequires: autoconf +BuildRequires: autoconf-archive BuildRequires: automake BuildRequires: libtool BuildRequires: gcc @@ -324,7 +325,6 @@ Provides: golang(%{import_path}/desktop/notification) = %{version}-%{releas Provides: golang(%{import_path}/desktop/notification/notificationtest) = %{version}-%{release} Provides: golang(%{import_path}/dirs) = %{version}-%{release} Provides: golang(%{import_path}/docs) = %{version}-%{release} -Provides: golang(%{import_path}/errtracker) = %{version}-%{release} Provides: golang(%{import_path}/features) = %{version}-%{release} Provides: golang(%{import_path}/gadget) = %{version}-%{release} Provides: golang(%{import_path}/gadget/edition) = %{version}-%{release} @@ -505,7 +505,7 @@ BUILDTAGS="nosecboot" %if ! 0%{?with_bundled} # We don't need the snapcore fork for bolt - it is just a fix on ppc -sed -e "s:github.com/snapcore/bolt:github.com/boltdb/bolt:g" -i advisor/*.go errtracker/*.go +sed -e "s:github.com/snapcore/bolt:github.com/boltdb/bolt:g" -i advisor/*.go %endif # We have to build snapd first to prevent the build from @@ -945,6 +945,157 @@ fi %changelog +* Fri Nov 24 2023 Ernest Lotter +- New upstream release 2.61.1 + - Stop requiring default provider snaps on image building and first + boot if alternative providers are included and available + - Fix auth.json access for login as non-root group ID + - Fix incorrect remodelling conflict when changing track to older + snapd version + - Improved check-rerefresh message + - Fix UC16/18 kernel/gadget update failure due volume mismatch with + installed disk + - Stop auto-import of assertions during install modes + - Desktop interface exposes GetIdletime + - Polkit interface support for new polkit versions + - Fix not applying snapd snap changes in tracked channel when remodelling + +* Fri Oct 13 2023 Philip Meulengracht +- New upstream release 2.61 + - Fix control of activated services in 'snap start' and 'snap stop' + - Correctly reflect activated services in 'snap services' + - Disabled services are no longer enabled again when snap is + refreshed + - interfaces/builtin: added support for Token2 U2F keys + - interfaces/u2f-devices: add Swissbit iShield Key + - interfaces/builtin: update gpio apparmor to match pattern that + contains multiple subdirectories under /sys/devices/platform + - interfaces: add a polkit-agent interface + - interfaces: add pcscd interface + - Kernel command-line can now be edited in the gadget.yaml + - Only track validation-sets in run-mode, fixes validation-set + issues on first boot. + - Added support for using store.access to disable access to snap + store + - Support for fat16 partition in gadget + - Pre-seed authority delegation is now possible + - Support new system-user name daemon + - Several bug fixes and improvements around remodelling + - Offline remodelling support + +* Fri Sep 15 2023 Michael Vogt +- New upstream release 2.60.4 + - i/b/qualcomm_ipc_router.go: switch to plug/slot and add socket + permission + - interfaces/builtin: fix custom-device udev KERNEL values + - overlord: allow the firmware-updater snap to install user daemons + - interfaces: allow loopback as a block-device + +* Fri Aug 25 2023 Michael Vogt +- New upstream release 2.60.3 + - i/b/shared-memory: handle "private" plug attribute in shared- + memory interface correctly + - i/apparmor: support for home.d tunables from /etc/ + +* Fri Aug 04 2023 Michael Vogt +- New upstream release 2.60.2 + - i/builtin: allow directories in private /dev/shm + - i/builtin: add read access to /proc/task/schedstat in system- + observe + - snap-bootstrap: print version information at startup + - go.mod: update gopkg.in/yaml.v3 to v3.0.1 to fix CVE-2022-28948 + - snap, store: filter out invalid snap edited links from store info + and persisted state + - o/configcore: write netplan defaults to 00-snapd-config on seeding + - snapcraft.yaml: pull in apparmor_parser optimization patches from + https://gitlab.com/apparmor/apparmor/-/merge_requests/711 + - snap-confine: fix missing \0 after readlink + - cmd/snap: hide append-integrity-data + - interfaces/opengl: add support for ARM Mali + +* Tue Jul 04 2023 Michael Vogt +- New upstream release 2.60.1 + - install: fallback to lazy unmount() in writeFilesystemContent + - data: include "modprobe.d" and "modules-load.d" in preseeded blob + - gadget: fix install test on armhf + - interfaces: fix typo in network_manager_observe + - sandbox/apparmor: don't let vendored apparmor conflict with system + - gadget/update: set parts in laid out data from the ones matched + - many: move SnapConfineAppArmorDir from dirs to sandbox/apparmor + - many: stop using `-O no-expr-simplify` in apparmor_parser + - go.mod: update secboot to latest uc22 branch + +* Thu Jun 15 2023 Michael Vogt +- New upstream release 2.60 + - Support for dynamic snapshot data exclusions + - Apparmor userspace is vendored inside the snapd snap + - Added a default-configure hook that exposes gadget default + configuration options to snaps during first install before + services are started + - Allow install from initrd to speed up the initial installation + for systems that do not have a install-device hook + - New `snap sign --chain` flag that appends the account and + account-key assertions + - Support validation-sets in the model assertion + - Support new "min-size" field in gadget.yaml + - New interface: "userns" + +* Sat May 27 2023 Michael Vogt +- New upstream release 2.59.5 + - Explicitly disallow the use of ioctl + TIOCLINUX + This fixes CVE-2023-1523. + +* Fri May 12 2023 Michael Vogt +- New upstream release 2.59.4 + - Retry when looking for disk label on non-UEFI systems + (LP: #2018977) + - Fix remodel from UC20 to UC22 + +* Wed May 03 2023 Michael Vogt +- New upstream release 2.59.3 + - Fix quiet boot + - i/b/physical_memory_observe: allow reading virt-phys page mappings + - gadget: warn instead of returning error if overlapping with GPT + header + - overlord,wrappers: restart always enabled units + - go.mod: update github.com/snapcore/secboot to latest uc22 + - boot: make sure we update assets for the system-seed-null role + - many: ignore case for vfat partitions when validating + +* Tue Apr 18 2023 Michael Vogt +- New upstream release 2.59.2 + - Notify users when a user triggered auto refresh finished + +* Tue Mar 28 2023 Michael Vogt +- New upstream release 2.59.1 + - Add udev rules from steam-devices to steam-support interface + - Bugfixes for layout path checking, dm_crypt permissions, + mount-control interface parameter checking, kernel commandline + parsing, docker-support, refresh-app-awareness + +* Fri Mar 10 2023 Michael Vogt +- New upstream release 2.59 + - Support setting extra kernel command line parameters via snap + configuration and under a gadget allow-list + - Support for Full-Disk-Encryption using ICE + - Support for arbitrary home dir locations via snap configuration + - New nvidia-drivers-support interface + - Support for udisks2 snap + - Pre-download of snaps ready for refresh and automatic refresh of + the snap when all apps are closed + - New microovn interface + - Support uboot with `CONFIG_SYS_REDUNDAND_ENV=n` + - Make "snap-preseed --reset" re-exec when needed + - Update the fwupd interface to support fully confined fwupd + - The memory,cpu,thread quota options are no longer experimental + - Support debugging snap client requests via the + `SNAPD_CLIENT_DEBUG_HTTP` environment variable + - Support ssh listen-address via snap configuration + - Support for quotas on single services + - prepare-image now takes into account snapd versions going into + the image, including in the kernel initrd, to fetch supported + assertion formats + * Wed Jan 17 2024 Zygmunt Krynicki - 2.58.3-3 - Require xdelta on Fedora or EPEL >= 9 (for delta updates) @@ -2506,13 +2657,18 @@ fi * Tue Feb 15 2022 Michael Vogt - New upstream release 2.54.3 - - bugfixes - -* Tue Jan 25 2022 Maciek Borzecki - 2.54.2-1 -- Release 2.54.2 to Fedora - -* Sat Jan 22 2022 Fedora Release Engineering - 2.54.1-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + - SECURITY UPDATE: Local privilege escalation + - snap-confine: Add validations of the location of the snap-confine + binary within snapd. + - snap-confine: Fix race condition in snap-confine when preparing a + private mount namespace for a snap. + - CVE-2021-44730 + - CVE-2021-44731 + - SECURITY UPDATE: Data injection from malicious snaps + - interfaces: Add validations of snap content interface and layout + paths in snapd. + - CVE-2021-4120 + - LP: #1949368 * Thu Jan 06 2022 Ian Johnson - New upstream release 2.54.2 @@ -5940,7 +6096,7 @@ fi - New upstream release 2.45.1 - data/selinux: allow checking /var/cache/app-info - cmd/snap-confine: add support for libc6-lse - - interfaces: miscellanious policy updates xlv + - interfaces: miscellaneous policy updates xlv - snap-bootstrap: remove sealed key file on reinstall - interfaces-ssh-keys: Support reading /etc/ssh/ssh_config.d/ - gadget: make ext4 filesystems with or without metadata checksum diff --git a/sources b/sources index 6ef3eef..753ce09 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (snapd_2.58.3.no-vendor.tar.xz) = c08a290d1c124947a760d883de0c69b78ee5d6fd751aa062ca5c8c4c3ce32adf3cd7cc6539dfea1c61e7766a82cb613570d2cdf3c660b269744ee43ed77b047f -SHA512 (snapd_2.58.3.only-vendor.tar.xz) = b9444711d0b057cd97e4ccb1e28f1c375db576369832fdc1a5f432004ddd5e9e252d454beeeae0f45913a187030f1274a1ba2d6f5730376e8818fba6da6a4599 +SHA512 (snapd_2.61.1.no-vendor.tar.xz) = 22f4550604392b04dd4ca903ebabf5631e87a6e11ac3ee8c6afcdf59f18ae2244967e3c9f2da01ddda883f33385b2c9e39648e3a9199efad6df75fff1b7106f9 +SHA512 (snapd_2.61.1.only-vendor.tar.xz) = 74d1ae7a1430f6215d7b8af28b877cb1af0ffaf62d7b4d102aba4f94aa97d81275250c573faa3922e160cd5e2545ea16da0afdc270f855aa20293973c2b23033 From 75acd1ae36cdf817ee6bdd5dfbb1fa51eb794256 Mon Sep 17 00:00:00 2001 From: Zygmunt Krynicki Date: Thu, 18 Jan 2024 11:59:41 +0100 Subject: [PATCH 05/35] Fix changelog chronology --- snapd.spec | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/snapd.spec b/snapd.spec index af9ab5b..9831198 100644 --- a/snapd.spec +++ b/snapd.spec @@ -945,6 +945,12 @@ fi %changelog +* Thu Jan 18 2024 Zygmunt Krynicki - 2.61.1-1 +- Changelog resynchronization + +* Wed Jan 17 2024 Zygmunt Krynicki - 2.58.3-3 +- Require xdelta on Fedora or EPEL >= 9 (for delta updates) + * Fri Nov 24 2023 Ernest Lotter - New upstream release 2.61.1 - Stop requiring default provider snaps on image building and first @@ -1096,9 +1102,6 @@ fi the image, including in the kernel initrd, to fetch supported assertion formats -* Wed Jan 17 2024 Zygmunt Krynicki - 2.58.3-3 -- Require xdelta on Fedora or EPEL >= 9 (for delta updates) - * Sat Jul 22 2023 Fedora Release Engineering - 2.58.3-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild From 86d010844c728954a21e31c8ea570d0ff439f83e Mon Sep 17 00:00:00 2001 From: Zygmunt Krynicki Date: Thu, 18 Jan 2024 13:07:13 +0100 Subject: [PATCH 06/35] Fix changelog chronology again Signed-off-by: Zygmunt Krynicki --- snapd.spec | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/snapd.spec b/snapd.spec index 9831198..df20cb4 100644 --- a/snapd.spec +++ b/snapd.spec @@ -1019,6 +1019,9 @@ fi - cmd/snap: hide append-integrity-data - interfaces/opengl: add support for ARM Mali +* Sat Jul 22 2023 Fedora Release Engineering - 2.58.3-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + * Tue Jul 04 2023 Michael Vogt - New upstream release 2.60.1 - install: fallback to lazy unmount() in writeFilesystemContent @@ -1102,9 +1105,6 @@ fi the image, including in the kernel initrd, to fetch supported assertion formats -* Sat Jul 22 2023 Fedora Release Engineering - 2.58.3-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - * Sat Feb 25 2023 Maciek Borzecki - 2.58.3-1 - Releate 2.58.3 to Fedora RHBZ#2173056 From 20dd3a781fa5bc455737870bd9af056869961d0a Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 27 Jan 2024 03:44:09 +0000 Subject: [PATCH 07/35] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild --- snapd.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/snapd.spec b/snapd.spec index df20cb4..16a6a58 100644 --- a/snapd.spec +++ b/snapd.spec @@ -84,7 +84,7 @@ Name: snapd Version: 2.61.1 -Release: 0%{?dist} +Release: 1%{?dist} Summary: A transactional software package manager License: GPLv3 URL: https://%{provider_prefix} @@ -945,6 +945,9 @@ fi %changelog +* Sat Jan 27 2024 Fedora Release Engineering - 2.61.1-1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + * Thu Jan 18 2024 Zygmunt Krynicki - 2.61.1-1 - Changelog resynchronization From e5b9be206eb0f63b13281f0e98ba40e9cc108c48 Mon Sep 17 00:00:00 2001 From: Maxwell G Date: Sun, 11 Feb 2024 23:37:54 +0000 Subject: [PATCH 08/35] Rebuild for golang 1.22.0 --- snapd.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/snapd.spec b/snapd.spec index 16a6a58..80bd674 100644 --- a/snapd.spec +++ b/snapd.spec @@ -84,7 +84,7 @@ Name: snapd Version: 2.61.1 -Release: 1%{?dist} +Release: 2%{?dist} Summary: A transactional software package manager License: GPLv3 URL: https://%{provider_prefix} @@ -945,6 +945,9 @@ fi %changelog +* Sun Feb 11 2024 Maxwell G - 2.61.1-2 +- Rebuild for golang 1.22.0 + * Sat Jan 27 2024 Fedora Release Engineering - 2.61.1-1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild From a6e939ca742c1f2d008923e498b24d9f9647aae4 Mon Sep 17 00:00:00 2001 From: Zygmunt Krynicki Date: Tue, 20 Feb 2024 14:18:31 +0100 Subject: [PATCH 09/35] Update to 2.61.2 Signed-off-by: Zygmunt Krynicki --- .gitignore | 2 ++ snapd.spec | 35 +++++++++++++++++++++++++++-------- sources | 4 ++-- 3 files changed, 31 insertions(+), 10 deletions(-) diff --git a/.gitignore b/.gitignore index 99cc85b..5d06100 100644 --- a/.gitignore +++ b/.gitignore @@ -100,3 +100,5 @@ /snapd_2.58.3.only-vendor.tar.xz /snapd_2.61.1.no-vendor.tar.xz /snapd_2.61.1.only-vendor.tar.xz +/snapd_2.61.2.no-vendor.tar.xz +/snapd_2.61.2.only-vendor.tar.xz diff --git a/snapd.spec b/snapd.spec index 80bd674..bb1c4d8 100644 --- a/snapd.spec +++ b/snapd.spec @@ -83,8 +83,8 @@ %{!?_tmpfilesdir: %global _tmpfilesdir %{_prefix}/lib/tmpfiles.d} Name: snapd -Version: 2.61.1 -Release: 2%{?dist} +Version: 2.61.2 +Release: 0%{?dist} Summary: A transactional software package manager License: GPLv3 URL: https://%{provider_prefix} @@ -169,6 +169,7 @@ License: GPLv3 BuildRequires: autoconf BuildRequires: autoconf-archive BuildRequires: automake +BuildRequires: make BuildRequires: libtool BuildRequires: gcc BuildRequires: gettext @@ -471,6 +472,8 @@ providing packages with %{import_path} prefix. %prep %if ! 0%{?with_bundled} %setup -q +# Ensure there's no bundled stuff accidentally leaking in... +rm -rf vendor/* %else # Extract each tarball properly %setup -q -D -b 1 @@ -488,7 +491,7 @@ mkdir -p src/github.com/snapcore ln -s ../../../ src/github.com/snapcore/snapd export GOPATH=$(pwd):%{gopath} -# remove the mod file, we are building without go modules support +# FIXME: move spec file really to a go.mod world instead of this hack rm -f go.mod export GO111MODULE=off @@ -686,11 +689,6 @@ rm %{buildroot}%{_libexecdir}/snapd/system-shutdown rm -f %{buildroot}%{_unitdir}/snapd.apparmor.service rm -f %{buildroot}%{_libexecdir}/snapd/snapd-apparmor -# Remove prompt services -rm %{buildroot}%{_unitdir}/snapd.aa-prompt-listener.service -rm %{buildroot}%{_userunitdir}/snapd.aa-prompt-ui.service -rm %{buildroot}%{_datadir}/dbus-1/services/io.snapcraft.Prompt.service - # Install Polkit configuration install -m 644 -D data/polkit/io.snapcraft.snapd.policy %{buildroot}%{_datadir}/polkit-1/actions @@ -747,6 +745,7 @@ export GOPATH=%{buildroot}/%{gopath}:%{gopath} %else export GOPATH=%{buildroot}/%{gopath}:$(pwd)/Godeps/_workspace:%{gopath} %endif +# FIXME: we are in the go.mod world now but without this things fall apart export GO111MODULE=off %gotest %{import_path}/... %endif @@ -945,6 +944,26 @@ fi %changelog +* Fri Feb 16 2024 Ernest Lotter +- New upstream release 2.61.2 + - Fix to enable plug/slot sanitization for prepare-image + - Fix panic when device-service.access=offline + - Support offline remodeling + - Allow offline update only remodels without serial + - Fail early when remodeling to old model revision + - Fix to enable plug/slot sanitization for validate-seed + - Allow removal of core snap on classic systems + - Fix network-control interface denial for file lock on /run/netns + - Add well-known core24 snap-id + - Fix remodel snap installation order + - Prevent remodeling from UC18+ to UC16 + - Fix cups auto-connect on classic with cups snap installed + - u2f-devices interface support for GoTrust Idem Key with USB-C + - Fix to restore services after unlink failure + - Add libcudnn.so to Nvidia libraries + - Fix skipping base snap download due to false snapd downgrade + conflict + * Sun Feb 11 2024 Maxwell G - 2.61.1-2 - Rebuild for golang 1.22.0 diff --git a/sources b/sources index 753ce09..cabce25 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (snapd_2.61.1.no-vendor.tar.xz) = 22f4550604392b04dd4ca903ebabf5631e87a6e11ac3ee8c6afcdf59f18ae2244967e3c9f2da01ddda883f33385b2c9e39648e3a9199efad6df75fff1b7106f9 -SHA512 (snapd_2.61.1.only-vendor.tar.xz) = 74d1ae7a1430f6215d7b8af28b877cb1af0ffaf62d7b4d102aba4f94aa97d81275250c573faa3922e160cd5e2545ea16da0afdc270f855aa20293973c2b23033 +SHA512 (snapd_2.61.2.no-vendor.tar.xz) = f9d1e5777b48af0144f7c92de63f7669dc58296e63dae0156d67e37178fad3c50c860a1d41bab468da3640a4e827a2a0fc07c427984d4f290e5100fe0d2c9a0d +SHA512 (snapd_2.61.2.only-vendor.tar.xz) = 7463f4dc8e9ecaca682104ff1d32162452c12801eeb9b528a44e6a1267de0bfe998dcbd15c76af932c8fdb88a9358e7a921910d3293618b3e44e8b4d2c0e19aa From 579bf936d6c11811a3bb5682977dfdfebff910b7 Mon Sep 17 00:00:00 2001 From: Zygmunt Krynicki Date: Mon, 15 Apr 2024 13:44:28 +0200 Subject: [PATCH 10/35] Update to 2.62 Signed-off-by: Zygmunt Krynicki --- .gitignore | 2 + snapd.spec | 130 ++++++++++++++++++++++++++++++++++++++++++++++++++++- sources | 4 +- 3 files changed, 133 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 5d06100..24dca27 100644 --- a/.gitignore +++ b/.gitignore @@ -102,3 +102,5 @@ /snapd_2.61.1.only-vendor.tar.xz /snapd_2.61.2.no-vendor.tar.xz /snapd_2.61.2.only-vendor.tar.xz +/snapd_2.62.no-vendor.tar.xz +/snapd_2.62.only-vendor.tar.xz diff --git a/snapd.spec b/snapd.spec index bb1c4d8..81658ad 100644 --- a/snapd.spec +++ b/snapd.spec @@ -83,7 +83,7 @@ %{!?_tmpfilesdir: %global _tmpfilesdir %{_prefix}/lib/tmpfiles.d} Name: snapd -Version: 2.61.2 +Version: 2.62 Release: 0%{?dist} Summary: A transactional software package manager License: GPLv3 @@ -597,6 +597,7 @@ install -d -p %{buildroot}%{_sysconfdir}/profile.d install -d -p %{buildroot}%{_sysconfdir}/sysconfig install -d -p %{buildroot}%{_sharedstatedir}/snapd/assertions install -d -p %{buildroot}%{_sharedstatedir}/snapd/cookie +install -d -p %{buildroot}%{_sharedstatedir}/snapd/cgroup install -d -p %{buildroot}%{_sharedstatedir}/snapd/dbus-1/services install -d -p %{buildroot}%{_sharedstatedir}/snapd/dbus-1/system-services install -d -p %{buildroot}%{_sharedstatedir}/snapd/desktop/applications @@ -944,6 +945,133 @@ fi %changelog +* Thu Mar 21 2024 Ernest Lotter +- New upstream release 2.62 + - Aspects based configuration schema support (experimental) + - Refresh app awareness support for UI (experimental) + - Support for user daemons by introducing new control switches + --user/--system/--users for service start/stop/restart + (experimental) + - Add AppArmor prompting experimental flag (feature currently + unsupported) + - Installation of local snap components of type test + - Packaging of components with snap pack + - Expose experimental features supported/enabled in snapd REST API + endpoint /v2/system-info + - Support creating and removing recovery systems for use by factory + reset + - Enable API route for creating and removing recovery systems using + /v2/systems with action create and /v2/systems/{label} with action + remove + - Lift requirements for fde-setup hook for single boot install + - Enable single reboot gadget update for UC20+ + - Allow core to be removed on classic systems + - Support for remodeling on hybrid systems + - Install desktop files on Ubuntu Core and update after snapd + upgrade + - Upgrade sandbox features to account for cgroup v2 device filtering + - Support snaps to manage their own cgroups + - Add support for AppArmor 4.0 unconfined profile mode + - Add AppArmor based read access to /etc/default/keyboard + - Upgrade to squashfuse 0.5.0 + - Support useradd utility to enable removing Perl dependency for + UC24+ + - Support for recovery-chooser to use console-conf snap + - Add support for --uid/--gid using strace-static + - Add support for notices (from pebble) and expose via the snapd + REST API endpoints /v2/notices and /v2/notice + - Add polkit authentication for snapd REST API endpoints + /v2/snaps/{snap}/conf and /v2/apps + - Add refresh-inhibit field to snapd REST API endpoint /v2/snaps + - Add refresh-inhibited select query to REST API endpoint /v2/snaps + - Take into account validation sets during remodeling + - Improve offline remodeling to use installed revisions of snaps to + fulfill the remodel revision requirement + - Add rpi configuration option sdtv_mode + - When snapd snap is not installed, pin policy ABI to 4.0 or 3.0 if + present on host + - Fix gadget zero-sized disk mapping caused by not ignoring zero + sized storage traits + - Fix gadget install case where size of existing partition was not + correctly taken into account + - Fix trying to unmount early kernel mount if it does not exist + - Fix restarting mount units on snapd start + - Fix call to udev in preseed mode + - Fix to ensure always setting up the device cgroup for base bare + and core24+ + - Fix not copying data from newly set homedirs on revision change + - Fix leaving behind empty snap home directories after snap is + removed (resulting in broken symlink) + - Fix to avoid using libzstd from host by adding to snapd snap + - Fix autorefresh to correctly handle forever refresh hold + - Fix username regex allowed for system-user assertion to not allow + '+' + - Fix incorrect application icon for notification after autorefresh + completion + - Fix to restart mount units when changed + - Fix to support AppArmor running under incus + - Fix case of snap-update-ns dropping synthetic mounts due to + failure to match desired mount dependencies + - Fix parsing of base snap version to enable pre-seeding of Ubuntu + Core Desktop + - Fix packaging and tests for various distributions + - Add remoteproc interface to allow developers to interact with + Remote Processor Framework which enables snaps to load firmware to + ARM Cortex microcontrollers + - Add kernel-control interface to enable controlling the kernel + firmware search path + - Add nfs-mount interface to allow mounting of NFS shares + - Add ros-opt-data interface to allow snaps to access the host + /opt/ros/ paths + - Add snap-refresh-observe interface that provides refresh-app- + awareness clients access to relevant snapd API endpoints + - steam-support interface: generalize Pressure Vessel root paths and + allow access to driver information, features and container + versions + - steam-support interface: make implicit on Ubuntu Core Desktop + - desktop interface: improved support for Ubuntu Core Desktop and + limit autoconnection to implicit slots + - cups-control interface: make autoconnect depend on presence of + cupsd on host to ensure it works on classic systems + - opengl interface: allow read access to /usr/share/nvidia + - personal-files interface: extend to support automatic creation of + missing parent directories in write paths + - network-control interface: allow creating /run/resolveconf + - network-setup-control and network-setup-observe interfaces: allow + busctl bind as required for systemd 254+ + - libvirt interface: allow r/w access to /run/libvirt/libvirt-sock- + ro and read access to /var/lib/libvirt/dnsmasq/** + - fwupd interface: allow access to IMPI devices (including locking + of device nodes), sysfs attributes needed by amdgpu and the COD + capsule update directory + - uio interface: allow configuring UIO drivers from userspace + libraries + - serial-port interface: add support for NXP Layerscape SoC + - lxd-support interface: add attribute enable-unconfined-mode to + require LXD to opt-in to run unconfined + - block-devices interface: add support for ZFS volumes + - system-packages-doc interface: add support for reading jquery and + sphinx documentation + - system-packages-doc interface: workaround to prevent autoconnect + failure for snaps using base bare + - microceph-support interface: allow more types of block devices to + be added as an OSD + - mount-observe interface: allow read access to + /proc/{pid}/task/{tid}/mounts and proc/{pid}/task/{tid}/mountinfo + - polkit interface: changed to not be implicit on core because + installing policy files is not possible + - upower-observe interface: allow stats refresh + - gpg-public-keys interface: allow creating lock file for certain + gpg operations + - shutdown interface: allow access to SetRebootParameter method + - media-control interface: allow device file locking + - u2f-devices interface: support for Trustkey G310H, JaCarta U2F, + Kensington VeriMark Guard, RSA DS100, Google Titan v2 + +* Wed Mar 06 2024 Ernest Lotter +- New upstream release 2.61.3 + - Install systemd files in correct location for 24.04 + * Fri Feb 16 2024 Ernest Lotter - New upstream release 2.61.2 - Fix to enable plug/slot sanitization for prepare-image diff --git a/sources b/sources index cabce25..869f45e 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (snapd_2.61.2.no-vendor.tar.xz) = f9d1e5777b48af0144f7c92de63f7669dc58296e63dae0156d67e37178fad3c50c860a1d41bab468da3640a4e827a2a0fc07c427984d4f290e5100fe0d2c9a0d -SHA512 (snapd_2.61.2.only-vendor.tar.xz) = 7463f4dc8e9ecaca682104ff1d32162452c12801eeb9b528a44e6a1267de0bfe998dcbd15c76af932c8fdb88a9358e7a921910d3293618b3e44e8b4d2c0e19aa +SHA512 (snapd_2.62.no-vendor.tar.xz) = 3fb9fa65e25e7deec7e92def9b60f756cfce35c00b90e5cc370bd641034414313f07c973fcbdef4c58e7a9abc20197316fd51a4a2bf5087088a0593b59104590 +SHA512 (snapd_2.62.only-vendor.tar.xz) = d07a3ba83cad8d25fc03ecb7efc69e8e3f105e41c076bc5b450acf4e98409f11f738b65f542965fac5ccaa56eb9f7b1b36aa06f8b68cd3549b9d2a01b10faa09 From c18e5e17bcc17ee6b4711886e6a785c9c8f58292 Mon Sep 17 00:00:00 2001 From: Zygmunt Krynicki Date: Mon, 27 May 2024 09:06:57 +0200 Subject: [PATCH 11/35] Update to 2.63 Small build change related to snap-seccomp, so that the progarm continues to build on rawhide (-D_GNU_SOURCE) and another change related to a stale removal of -Bstatic. Signed-off-by: Zygmunt Krynicki --- .gitignore | 108 +---------------------------------------------------- snapd.spec | 63 +++++++++++++++++++++++++++---- sources | 4 +- 3 files changed, 59 insertions(+), 116 deletions(-) diff --git a/.gitignore b/.gitignore index 24dca27..e5d0e26 100644 --- a/.gitignore +++ b/.gitignore @@ -1,106 +1,2 @@ -/snapcore-selinux-6331fd4.tar.gz -/snapd-2.16.tar.gz -/snapcore-selinux-e5c1177.tar.gz -/snapcore-selinux-4566045.tar.gz -/snapd-2.23.6.tar.gz -/snapd-2.24.tar.gz -/snapd-2.25.tar.gz -/snapd-2.26.3.tar.gz -/snapd-2.27.tar.gz -/snapd-2.27.1.tar.gz -/snapd-2.27.2.tar.gz -/snapd-2.27.5.tar.gz -/snapd-2.27.6.tar.gz -/snapd-2.28.1.tar.gz -/snapd-2.28.4.tar.gz -/snapd-2.28.5.tar.gz -/snapd-2.29.4.tar.gz -/snapd-2.30.tar.gz -/snapd-2.31.1.tar.gz -/snapd-2.32.4.tar.gz -/snapd-2.33.1.tar.gz -/snapd-2.35.tar.gz -/snapd-2.36.tar.gz -/snapd_2.36.only-vendor.tar.xz -/snapd-2.36.3.tar.gz -/snapd_2.36.3.only-vendor.tar.xz -/snapd-2.37.2.tar.gz -/snapd_2.37.2.only-vendor.tar.xz -/snapd-2.37.3.tar.gz -/snapd_2.37.3.only-vendor.tar.xz -/snapd-2.37.4.tar.gz -/snapd_2.37.4.only-vendor.tar.xz -/snapd_2.38.no-vendor.tar.xz -/snapd_2.38.only-vendor.tar.xz -/snapd_2.39.no-vendor.tar.xz -/snapd_2.39.only-vendor.tar.xz -/snapd_2.39.1.no-vendor.tar.xz -/snapd_2.39.1.only-vendor.tar.xz -/snapd_2.39.2.no-vendor.tar.xz -/snapd_2.39.2.only-vendor.tar.xz -/snapd_2.41.no-vendor.tar.xz -/snapd_2.41.only-vendor.tar.xz -/snapd_2.42.no-vendor.tar.xz -/snapd_2.42.only-vendor.tar.xz -/snapd_2.42.1.no-vendor.tar.xz -/snapd_2.42.1.only-vendor.tar.xz -/snapd_2.42.2.no-vendor.tar.xz -/snapd_2.42.2.only-vendor.tar.xz -/snapd_2.43.3.no-vendor.tar.xz -/snapd_2.43.3.only-vendor.tar.xz -/snapd_2.45.no-vendor.tar.xz -/snapd_2.45.only-vendor.tar.xz -/snapd_2.45.1.no-vendor.tar.xz -/snapd_2.45.1.only-vendor.tar.xz -/snapd_2.45.2.no-vendor.tar.xz -/snapd_2.45.2.only-vendor.tar.xz -/snapd_2.45.3.1.no-vendor.tar.xz -/snapd_2.45.3.1.only-vendor.tar.xz -/snapd_2.46.1.no-vendor.tar.xz -/snapd_2.46.1.only-vendor.tar.xz -/snapd_2.47.1.no-vendor.tar.xz -/snapd_2.47.1.only-vendor.tar.xz -/snapd_2.48.2.no-vendor.tar.xz -/snapd_2.48.2.only-vendor.tar.xz -/snapd_2.49.no-vendor.tar.xz -/snapd_2.49.only-vendor.tar.xz -/snapd_2.50.no-vendor.tar.xz -/snapd_2.50.only-vendor.tar.xz -/snapd_2.51.no-vendor.tar.xz -/snapd_2.51.only-vendor.tar.xz -/snapd_2.51.7.no-vendor.tar.xz -/snapd_2.51.7.only-vendor.tar.xz -/snapd_2.52.no-vendor.tar.xz -/snapd_2.52.only-vendor.tar.xz -/snapd_2.53.1.no-vendor.tar.xz -/snapd_2.53.1.only-vendor.tar.xz -/snapd_2.53.2.no-vendor.tar.xz -/snapd_2.53.2.only-vendor.tar.xz -/snapd_2.53.4.no-vendor.tar.xz -/snapd_2.53.4.only-vendor.tar.xz -/snapd_2.54.1.no-vendor.tar.xz -/snapd_2.54.1.only-vendor.tar.xz -/snapd_2.54.2.no-vendor.tar.xz -/snapd_2.54.2.only-vendor.tar.xz -/snapd_2.54.3.no-vendor.tar.xz -/snapd_2.54.3.only-vendor.tar.xz -/snapd_2.54.4.no-vendor.tar.xz -/snapd_2.54.4.only-vendor.tar.xz -/snapd_2.55.2.no-vendor.tar.xz -/snapd_2.55.2.only-vendor.tar.xz -/snapd_2.55.3.no-vendor.tar.xz -/snapd_2.55.3.only-vendor.tar.xz -/snapd_2.56.2.no-vendor.tar.xz -/snapd_2.56.2.only-vendor.tar.xz -/snapd_2.57.5.no-vendor.tar.xz -/snapd_2.57.5.only-vendor.tar.xz -/snapd_2.57.6.no-vendor.tar.xz -/snapd_2.57.6.only-vendor.tar.xz -/snapd_2.58.3.no-vendor.tar.xz -/snapd_2.58.3.only-vendor.tar.xz -/snapd_2.61.1.no-vendor.tar.xz -/snapd_2.61.1.only-vendor.tar.xz -/snapd_2.61.2.no-vendor.tar.xz -/snapd_2.61.2.only-vendor.tar.xz -/snapd_2.62.no-vendor.tar.xz -/snapd_2.62.only-vendor.tar.xz +/snapd_2.63.no-vendor.tar.xz +/snapd_2.63.only-vendor.tar.xz diff --git a/snapd.spec b/snapd.spec index 81658ad..274ae7b 100644 --- a/snapd.spec +++ b/snapd.spec @@ -83,7 +83,7 @@ %{!?_tmpfilesdir: %global _tmpfilesdir %{_prefix}/lib/tmpfiles.d} Name: snapd -Version: 2.62 +Version: 2.63 Release: 0%{?dist} Summary: A transactional software package manager License: GPLv3 @@ -132,7 +132,7 @@ Provides: %{name}-login-service%{?_isa} = 1.33 %endif %if ! 0%{?with_bundled} -BuildRequires: golang(github.com/boltdb/bolt) +BuildRequires: golang(go.etcd.io/bbolt) BuildRequires: golang(github.com/coreos/go-systemd/activation) BuildRequires: golang(github.com/godbus/dbus) BuildRequires: golang(github.com/godbus/dbus/introspect) @@ -225,7 +225,7 @@ BuildArch: noarch %endif %if ! 0%{?with_bundled} -Requires: golang(github.com/boltdb/bolt) +Requires: golang(go.etcd.io/bbolt) Requires: golang(github.com/coreos/go-systemd/activation) Requires: golang(github.com/godbus/dbus) Requires: golang(github.com/godbus/dbus/introspect) @@ -254,7 +254,7 @@ Requires: golang(gopkg.in/yaml.v3) # These Provides are unversioned because the sources in # the bundled tarball are unversioned (they go by git commit) # *sigh*... I hate golang... -Provides: bundled(golang(github.com/snapcore/bolt)) +Provides: bundled(golang(go.etcd.io/bbolt)) Provides: bundled(golang(github.com/coreos/go-systemd/activation)) Provides: bundled(golang(github.com/godbus/dbus)) Provides: bundled(golang(github.com/godbus/dbus/introspect)) @@ -534,10 +534,8 @@ BUILDTAGS="${BUILDTAGS} nomanagers" %gobuild_static -o bin/snapctl $GOFLAGS %{import_path}/cmd/snapctl ) -%if 0%{?rhel} -# There's no static link library for libseccomp in RHEL/CentOS... -sed -e "s/-Bstatic -lseccomp/-Bstatic/g" -i cmd/snap-seccomp/*.go -%endif +# We need -D_GNU_SOURCE to include xfs/linux.h for fallocate. +sed -e 's,//#cgo CFLAGS: -D_FILE_OFFSET_BITS=64,//#cgo CFLAGS: -D_FILE_OFFSET_BITS=64 -D_GNU_SOURCE,' -i cmd/snap-seccomp/main.go %gobuild -o bin/snap-seccomp $GOFLAGS %{import_path}/cmd/snap-seccomp ( @@ -809,6 +807,7 @@ popd %dir %{_sharedstatedir}/snapd %dir %{_sharedstatedir}/snapd/assertions %dir %{_sharedstatedir}/snapd/cookie +%dir %{_sharedstatedir}/snapd/cgroup %dir %{_sharedstatedir}/snapd/dbus-1 %dir %{_sharedstatedir}/snapd/dbus-1/services %dir %{_sharedstatedir}/snapd/dbus-1/system-services @@ -945,6 +944,54 @@ fi %changelog +* Wed Apr 24 2024 Ernest Lotter +- New upstream release 2.63 + - Support for snap services to show the current status of user + services (experimental) + - Refresh app awareness: record snap-run-inhibit notice when + starting app from snap that is busy with refresh (experimental) + - Refresh app awareness: use warnings as fallback for desktop + notifications (experimental) + - Aspect based configuration: make request fields in the aspect- + bundle's rules optional (experimental) + - Aspect based configuration: make map keys conform to the same + format as path sub-keys (experimental) + - Aspect based configuration: make unset and set behaviour similar + to configuration options (experimental) + - Aspect based configuration: limit nesting level for setting value + (experimental) + - Components: use symlinks to point active snap component revisions + - Components: add model assertion support for components + - Components: fix to ensure local component installation always gets + a new revision number + - Add basic support for a CIFS remote filesystem-based home + directory + - Add support for AppArmor profile kill mode to avoid snap-confine + error + - Allow more than one interface to grant access to the same API + endpoint or notice type + - Allow all snapd service's control group processes to send systemd + notifications to prevent warnings flooding the log + - Enable not preseeded single boot install + - Update secboot to handle new sbatlevel + - Fix to not use cgroup for non-strict confined snaps (devmode, + classic) + - Fix two race conditions relating to freedesktop notifications + - Fix missing tunables in snap-update-ns AppArmor template + - Fix rejection of snapd snap udev command line by older host snap- + device-helper + - Rework seccomp allow/deny list + - Clean up files removed by gadgets + - Remove non-viable boot chains to avoid secboot failure + - posix_mq interface: add support for missing time64 mqueue syscalls + mq_timedreceive_time64 and mq_timedsend_time64 + - password-manager-service interface: allow kwalletd version 6 + - kubernetes-support interface: allow SOCK_SEQPACKET sockets + - system-observe interface: allow listing systemd units and their + properties + - opengl interface: enable use of nvidia container toolkit CDI + config generation + * Thu Mar 21 2024 Ernest Lotter - New upstream release 2.62 - Aspects based configuration schema support (experimental) diff --git a/sources b/sources index 869f45e..569bfcb 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (snapd_2.62.no-vendor.tar.xz) = 3fb9fa65e25e7deec7e92def9b60f756cfce35c00b90e5cc370bd641034414313f07c973fcbdef4c58e7a9abc20197316fd51a4a2bf5087088a0593b59104590 -SHA512 (snapd_2.62.only-vendor.tar.xz) = d07a3ba83cad8d25fc03ecb7efc69e8e3f105e41c076bc5b450acf4e98409f11f738b65f542965fac5ccaa56eb9f7b1b36aa06f8b68cd3549b9d2a01b10faa09 +SHA512 (snapd_2.63.no-vendor.tar.xz) = 5973b7922f2caf1d4b0bc0db4fe5564134b04d6ca3b52204e9963b584bd80a91789c46902840169f9a8b1b1184820c86902401f585915ca06a010d81a2d9a453 +SHA512 (snapd_2.63.only-vendor.tar.xz) = 3ff9b8610c01997935b720e883644597f7d397a9a7b7e23eadbe95a67f62564e9d4d836c5667e39f95ed073115b106d58e5f4107f229c72014433414168baaa7 From 7c22be110172fd0806c7177191fcad035ce3a10e Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 20 Jul 2024 05:56:41 +0000 Subject: [PATCH 12/35] Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild --- snapd.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/snapd.spec b/snapd.spec index 274ae7b..ce1d339 100644 --- a/snapd.spec +++ b/snapd.spec @@ -84,7 +84,7 @@ Name: snapd Version: 2.63 -Release: 0%{?dist} +Release: 1%{?dist} Summary: A transactional software package manager License: GPLv3 URL: https://%{provider_prefix} @@ -944,6 +944,9 @@ fi %changelog +* Sat Jul 20 2024 Fedora Release Engineering - 2.63-1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + * Wed Apr 24 2024 Ernest Lotter - New upstream release 2.63 - Support for snap services to show the current status of user From 68b9487a1aae8bec4ab3b68f8b3e582c2f1cb66c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miroslav=20Such=C3=BD?= Date: Fri, 26 Jul 2024 03:00:09 +0200 Subject: [PATCH 13/35] convert GPLv2+ license to SPDX This is part of https://fedoraproject.org/wiki/Changes/SPDX_Licenses_Phase_4 --- snapd.spec | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/snapd.spec b/snapd.spec index ce1d339..e0e1eac 100644 --- a/snapd.spec +++ b/snapd.spec @@ -84,7 +84,7 @@ Name: snapd Version: 2.63 -Release: 1%{?dist} +Release: 2%{?dist} Summary: A transactional software package manager License: GPLv3 URL: https://%{provider_prefix} @@ -204,7 +204,8 @@ the started snap applications. %package selinux Summary: SELinux module for snapd -License: GPLv2+ +# Automatically converted from old format: GPLv2+ - review is highly recommended. +License: GPL-2.0-or-later BuildArch: noarch BuildRequires: selinux-policy BuildRequires: selinux-policy-devel @@ -944,6 +945,9 @@ fi %changelog +* Fri Jul 26 2024 Miroslav Suchý - 2.63-2 +- convert license to SPDX + * Sat Jul 20 2024 Fedora Release Engineering - 2.63-1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild From 91f15ef391a79fbdb7bee2f6dd807b1d6f6af7cf Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miroslav=20Such=C3=BD?= Date: Mon, 29 Jul 2024 14:39:36 +0200 Subject: [PATCH 14/35] convert GPLv3 license to SPDX This is part of https://fedoraproject.org/wiki/Changes/SPDX_Licenses_Phase_4 --- snapd.spec | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/snapd.spec b/snapd.spec index e0e1eac..ed23d7c 100644 --- a/snapd.spec +++ b/snapd.spec @@ -84,9 +84,10 @@ Name: snapd Version: 2.63 -Release: 2%{?dist} +Release: 3%{?dist} Summary: A transactional software package manager -License: GPLv3 +# Automatically converted from old format: GPLv3 - review is highly recommended. +License: GPL-3.0-only URL: https://%{provider_prefix} Source0: https://%{provider_prefix}/releases/download/%{version}/%{name}_%{version}.no-vendor.tar.xz Source1: https://%{provider_prefix}/releases/download/%{version}/%{name}_%{version}.only-vendor.tar.xz @@ -165,7 +166,8 @@ designed for working with self-contained, immutable packages. %package -n snap-confine Summary: Confinement system for snap applications -License: GPLv3 +# Automatically converted from old format: GPLv3 - review is highly recommended. +License: GPL-3.0-only BuildRequires: autoconf BuildRequires: autoconf-archive BuildRequires: automake @@ -945,6 +947,9 @@ fi %changelog +* Mon Jul 29 2024 Miroslav Suchý - 2.63-3 +- convert license to SPDX + * Fri Jul 26 2024 Miroslav Suchý - 2.63-2 - convert license to SPDX From fc5296778e513eb17e5c98c24ecdd33049123dc0 Mon Sep 17 00:00:00 2001 From: Zygmunt Krynicki Date: Thu, 5 Sep 2024 09:59:15 +0200 Subject: [PATCH 15/35] Update to 2.65.1 The 2.64 and 2.65 releases were skipped as they failed to pass QA. The changelog was updated to retain correct ordering. Remove comments to check automatically converted license identifiers. Signed-off-by: Zygmunt Krynicki --- .gitignore | 4 +- snapd.spec | 410 ++++++++++++++++++++++++++++++++++++++++++++++++++--- sources | 4 +- 3 files changed, 397 insertions(+), 21 deletions(-) diff --git a/.gitignore b/.gitignore index e5d0e26..2e14c48 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,2 @@ -/snapd_2.63.no-vendor.tar.xz -/snapd_2.63.only-vendor.tar.xz +/snapd_2.65.1.no-vendor.tar.xz +/snapd_2.65.1.only-vendor.tar.xz diff --git a/snapd.spec b/snapd.spec index ed23d7c..f336734 100644 --- a/snapd.spec +++ b/snapd.spec @@ -83,10 +83,9 @@ %{!?_tmpfilesdir: %global _tmpfilesdir %{_prefix}/lib/tmpfiles.d} Name: snapd -Version: 2.63 -Release: 3%{?dist} +Version: 2.65.1 +Release: 0%{?dist} Summary: A transactional software package manager -# Automatically converted from old format: GPLv3 - review is highly recommended. License: GPL-3.0-only URL: https://%{provider_prefix} Source0: https://%{provider_prefix}/releases/download/%{version}/%{name}_%{version}.no-vendor.tar.xz @@ -134,6 +133,7 @@ Provides: %{name}-login-service%{?_isa} = 1.33 %if ! 0%{?with_bundled} BuildRequires: golang(go.etcd.io/bbolt) +BuildRequires: golang(github.com/bmatcuk/doublestar/v4) BuildRequires: golang(github.com/coreos/go-systemd/activation) BuildRequires: golang(github.com/godbus/dbus) BuildRequires: golang(github.com/godbus/dbus/introspect) @@ -166,7 +166,6 @@ designed for working with self-contained, immutable packages. %package -n snap-confine Summary: Confinement system for snap applications -# Automatically converted from old format: GPLv3 - review is highly recommended. License: GPL-3.0-only BuildRequires: autoconf BuildRequires: autoconf-archive @@ -206,7 +205,6 @@ the started snap applications. %package selinux Summary: SELinux module for snapd -# Automatically converted from old format: GPLv2+ - review is highly recommended. License: GPL-2.0-or-later BuildArch: noarch BuildRequires: selinux-policy @@ -229,6 +227,7 @@ BuildArch: noarch %if ! 0%{?with_bundled} Requires: golang(go.etcd.io/bbolt) +Requires: golang(github.com/bmatcuk/doublestar/v4) Requires: golang(github.com/coreos/go-systemd/activation) Requires: golang(github.com/godbus/dbus) Requires: golang(github.com/godbus/dbus/introspect) @@ -258,6 +257,7 @@ Requires: golang(gopkg.in/yaml.v3) # the bundled tarball are unversioned (they go by git commit) # *sigh*... I hate golang... Provides: bundled(golang(go.etcd.io/bbolt)) +Provides: bundled(golang(github.com/bmatcuk/doublestar/v4)) Provides: bundled(golang(github.com/coreos/go-systemd/activation)) Provides: bundled(golang(github.com/godbus/dbus)) Provides: bundled(golang(github.com/godbus/dbus/introspect)) @@ -486,8 +486,6 @@ rm -rf vendor/* %build -# We don't want/need squashfuse in the rpm, as it's available in Fedora and EPEL -sed -e 's:_ "github.com/snapcore/squashfuse"::g' -i systemd/systemd.go # Build snapd mkdir -p src/github.com/snapcore @@ -537,8 +535,6 @@ BUILDTAGS="${BUILDTAGS} nomanagers" %gobuild_static -o bin/snapctl $GOFLAGS %{import_path}/cmd/snapctl ) -# We need -D_GNU_SOURCE to include xfs/linux.h for fallocate. -sed -e 's,//#cgo CFLAGS: -D_FILE_OFFSET_BITS=64,//#cgo CFLAGS: -D_FILE_OFFSET_BITS=64 -D_GNU_SOURCE,' -i cmd/snap-seccomp/main.go %gobuild -o bin/snap-seccomp $GOFLAGS %{import_path}/cmd/snap-seccomp ( @@ -603,6 +599,7 @@ install -d -p %{buildroot}%{_sharedstatedir}/snapd/dbus-1/services install -d -p %{buildroot}%{_sharedstatedir}/snapd/dbus-1/system-services install -d -p %{buildroot}%{_sharedstatedir}/snapd/desktop/applications install -d -p %{buildroot}%{_sharedstatedir}/snapd/device +install -d -p %{buildroot}%{_sharedstatedir}/snapd/environment install -d -p %{buildroot}%{_sharedstatedir}/snapd/hostfs install -d -p %{buildroot}%{_sharedstatedir}/snapd/inhibit install -d -p %{buildroot}%{_sharedstatedir}/snapd/lib/gl @@ -655,8 +652,6 @@ pushd ./cmd chmod 0755 %{buildroot}%{_sharedstatedir}/snapd/void # We don't use AppArmor rm -rfv %{buildroot}%{_sysconfdir}/apparmor.d -# ubuntu-core-launcher is dead -rm -fv %{buildroot}%{_bindir}/ubuntu-core-launcher popd # Install all systemd and dbus units, and env files @@ -667,9 +662,6 @@ pushd ./data SNAP_MOUNT_DIR="%{_sharedstatedir}/snapd/snap" \ SNAPD_ENVIRONMENT_FILE="%{_sysconfdir}/sysconfig/snapd" popd -# Sudo tweaks do not work anyway, see -# https://bugzilla.redhat.com/show_bug.cgi?id=1691996 for more details -rm -rfv %{buildroot}%{_sysconfdir}/sudoers.d %if 0%{?rhel} == 7 # Install kernel tweaks @@ -691,9 +683,6 @@ rm %{buildroot}%{_libexecdir}/snapd/system-shutdown rm -f %{buildroot}%{_unitdir}/snapd.apparmor.service rm -f %{buildroot}%{_libexecdir}/snapd/snapd-apparmor -# Install Polkit configuration -install -m 644 -D data/polkit/io.snapcraft.snapd.policy %{buildroot}%{_datadir}/polkit-1/actions - # Disable re-exec by default echo 'SNAP_REEXEC=0' > %{buildroot}%{_sysconfdir}/sysconfig/snapd @@ -947,12 +936,399 @@ fi %changelog +* Sat Aug 24 2024 Ernest Lotter +- New upstream release 2.65.1 + - Support building snapd using base Core22 (Snapcraft 8.x) + - FIPS: support building FIPS complaint snapd variant that switches + to FIPS mode when the system boots with FIPS enabled + - AppArmor: update to latest 4.0.2 release + - AppArmor: enable using ABI 4.0 from host parser + - AppArmor: fix parser lookup + - AppArmor: support AppArmor snippet priorities + - AppArmor: allow reading cgroup memory.max file + - AppArmor: allow using snap-exec coming from the snapd snap when + starting a confined process with jailmode + - AppArmor prompting (experimental): add checks for prompting + support, include prompting status in system key, and restart snapd + if prompting flag changes + - AppArmor prompting (experimental): include prompt prefix in + AppArmor rules if prompting is supported and enabled + - AppArmor prompting (experimental): add common types, constraints, + and mappings from AppArmor permissions to abstract permissions + - AppArmor prompting (experimental): add path pattern parsing and + matching + - AppArmor prompting (experimental): add path pattern precedence + based on specificity + - AppArmor prompting (experimental): add packages to manage + outstanding request prompts and rules + - AppArmor prompting (experimental): add prompting API and notice + types, which require snap-interfaces-requests-control interface + - AppArmor prompting (experimental): feature flag can only be + enabled if prompting is supported, handler service connected, and + the service can be started + - Registry views (experimental): rename from aspects to registries + - Registry views (experimental): support reading registry views and + setting/unsetting registry data using snapctl + - Registry views (experimental): fetch and refresh registry + assertions as needed + - Registry views (experimental): restrict view paths from using a + number as first character and view names to storage path style + patterns + - Snap components: support installing snaps and components from + files at the same time (no REST API/CLI) + - Snap components: support downloading components related assertions + from the store + - Snap components: support installing components from the store + - Snap components: support removing components individually and + during snap removal + - Snap components: support kernel modules as components + - Snap components: support for component install, pre-refresh and + post-refresh hooks + - Snap components: initial support for building systems that contain + components + - Refresh app awareness (experimental): add data field for + /v2/changes REST API to allow associating each task with affected + snaps + - Refresh app awareness (experimental): use the app name from + .desktop file in notifications + - Refresh app awareness (experimental): give snap-refresh-observe + interface access to /v2/snaps/{name} endpoint + - Improve snap-confine compatibility with nvidia drivers + - Allow re-exec when SNAP_REEXEC is set for unlisted distros to + simplify testing + - Allow mixing revision and channel on snap install + - Generate GNU build ID for Go binaries + - Add missing etelpmoc.sh for shell completion + - Do not attempt to run snapd on classic when re-exec is disabled + - Packaging/build maintenance for Debian sid, Fedora, Arch, openSuse + - Add snap debug API command to enable running raw queries + - Enable snap-confine snap mount directory detection + - Replace global seccomp filter with deny rules in standard seccomp + template + - Remove support for Ubuntu Core Launcher (superseded by snap- + confine) + - Support creating pending serial bound users after serial assertion + becomes available + - Support disabling cloud-init using kernel command-line + - In hybrid systems, apps can refresh without waiting for restarts + required by essential snaps + - Ship snap-debug-info.sh script used for system diagnostics + - Improve error messages when attempting to run non-existent snap + - Switch to -u UID:GID for strace-static + - Support enabling snapd logging with snap set system + debug.snapd.{log,log-level} + - Add options system.coredump.enable and system.coredump.maxuse to + support using systemd-coredump on Ubuntu Core + - Provide documentation URL for 'snap interface ' + - Fix snapd riscv64 build + - Fix restarting activated services instead of their activator units + (i.e. sockets, timers) + - Fix potential unexpected auto-refresh of snap on managed schedule + - Fix potential segfault by guarding against kernel command-line + changes on classic system + - Fix proxy entries in /etc/environment with missing newline that + caused later manual entries to not be usable + - Fix offline remodelling by ignoring prerequisites that will + otherwise be downloaded from store + - Fix devmode seccomp deny regression that caused spamming the log + instead of actual denies + - Fix snap lock leak during refresh + - Fix not re-pinning validation sets that were already pinned when + enforcing new validation sets + - Fix handling of unexpected snapd runtime failure + - Fix /v2/notices REST API skipping notices with duplicate + timestamps + - Fix comparing systemd versions that may contain pre-release + suffixes + - Fix udev potentially starting before snap-device-helper is made + available + - Fix race in snap seed metadata loading + - Fix treating cloud-init exit status 2 as error + - Fix to prevent sending refresh complete notification if snap snap- + refresh-observe interface is connected + - Fix to queue snapctl service commands if run from the default- + configure hook to ensure they get up-to-date config values + - Fix stop service failure when the service is not actually running + anymore + - Fix parsing /proc/PID/mounts with spaces + - Add registry interface that provides snaps access to a particular + registry view + - Add snap-interfaces-requests-control interface to enable prompting + client snaps + - steam-support interface: remove all AppArmor and seccomp + restrictions to improve user experience + - opengl interface: improve compatibility with nvidia drivers + - home interface: autoconnect home on Ubuntu Core Desktop + - serial-port interface: support RPMsg tty + - display-control interface: allow changing LVDS backlight power and + brightness + - power-control interface: support for battery charging thesholds, + type/status and AC type/status + - cpu-control interface: allow CPU C-state control + - raw-usb interface: support RPi5 and Thinkpad x13s + - custom-device interface: allow device file locking + - lxd-support interface: allow LXD to self-manage its own cgroup + - network-manager interface: support MPTCP sockets + - network-control interface: allow plug/slot access to gnutls config + and systemd resolved cache flushing via D-Bus + - network-control interface: allow wpa_supplicant dbus api + - gpio-control interface: support gpiochip* devices + - polkit interface: fix "rw" mount option check + - u2f-devices interface: enable additional security keys + - desktop interface: enable kde theming support + +* Fri Aug 23 2024 Ernest Lotter +- New upstream release 2.65 + - Support building snapd using base Core22 (Snapcraft 8.x) + - FIPS: support building FIPS complaint snapd variant that switches + to FIPS mode when the system boots with FIPS enabled + - AppArmor: update to latest 4.0.2 release + - AppArmor: enable using ABI 4.0 from host parser + - AppArmor: fix parser lookup + - AppArmor: support AppArmor snippet priorities + - AppArmor: allow reading cgroup memory.max file + - AppArmor: allow using snap-exec coming from the snapd snap when + starting a confined process with jailmode + - AppArmor prompting (experimental): add checks for prompting + support, include prompting status in system key, and restart snapd + if prompting flag changes + - AppArmor prompting (experimental): include prompt prefix in + AppArmor rules if prompting is supported and enabled + - AppArmor prompting (experimental): add common types, constraints, + and mappings from AppArmor permissions to abstract permissions + - AppArmor prompting (experimental): add path pattern parsing and + matching + - AppArmor prompting (experimental): add path pattern precedence + based on specificity + - AppArmor prompting (experimental): add packages to manage + outstanding request prompts and rules + - AppArmor prompting (experimental): add prompting API and notice + types, which require snap-interfaces-requests-control interface + - AppArmor prompting (experimental): feature flag can only be + enabled if prompting is supported, handler service connected, and + the service can be started + - Registry views (experimental): rename from aspects to registries + - Registry views (experimental): support reading registry views and + setting/unsetting registry data using snapctl + - Registry views (experimental): fetch and refresh registry + assertions as needed + - Registry views (experimental): restrict view paths from using a + number as first character and view names to storage path style + patterns + - Snap components: support installing snaps and components from + files at the same time (no REST API/CLI) + - Snap components: support downloading components related assertions + from the store + - Snap components: support installing components from the store + - Snap components: support removing components individually and + during snap removal + - Snap components: support kernel modules as components + - Snap components: support for component install, pre-refresh and + post-refresh hooks + - Snap components: initial support for building systems that contain + components + - Refresh app awareness (experimental): add data field for + /v2/changes REST API to allow associating each task with affected + snaps + - Refresh app awareness (experimental): use the app name from + .desktop file in notifications + - Refresh app awareness (experimental): give snap-refresh-observe + interface access to /v2/snaps/{name} endpoint + - Improve snap-confine compatibility with nvidia drivers + - Allow re-exec when SNAP_REEXEC is set for unlisted distros to + simplify testing + - Allow mixing revision and channel on snap install + - Generate GNU build ID for Go binaries + - Add missing etelpmoc.sh for shell completion + - Do not attempt to run snapd on classic when re-exec is disabled + - Packaging/build maintenance for Debian sid, Fedora, Arch, openSuse + - Add snap debug API command to enable running raw queries + - Enable snap-confine snap mount directory detection + - Replace global seccomp filter with deny rules in standard seccomp + template + - Remove support for Ubuntu Core Launcher (superseded by snap- + confine) + - Support creating pending serial bound users after serial assertion + becomes available + - Support disabling cloud-init using kernel command-line + - In hybrid systems, apps can refresh without waiting for restarts + required by essential snaps + - Ship snap-debug-info.sh script used for system diagnostics + - Improve error messages when attempting to run non-existent snap + - Switch to -u UID:GID for strace-static + - Support enabling snapd logging with snap set system + debug.snapd.{log,log-level} + - Add options system.coredump.enable and system.coredump.maxuse to + support using systemd-coredump on Ubuntu Core + - Provide documentation URL for 'snap interface ' + - Fix restarting activated services instead of their activator units + (i.e. sockets, timers) + - Fix potential unexpected auto-refresh of snap on managed schedule + - Fix potential segfault by guarding against kernel command-line + changes on classic system + - Fix proxy entries in /etc/environment with missing newline that + caused later manual entries to not be usable + - Fix offline remodelling by ignoring prerequisites that will + otherwise be downloaded from store + - Fix devmode seccomp deny regression that caused spamming the log + instead of actual denies + - Fix snap lock leak during refresh + - Fix not re-pinning validation sets that were already pinned when + enforcing new validation sets + - Fix handling of unexpected snapd runtime failure + - Fix /v2/notices REST API skipping notices with duplicate + timestamps + - Fix comparing systemd versions that may contain pre-release + suffixes + - Fix udev potentially starting before snap-device-helper is made + available + - Fix race in snap seed metadata loading + - Fix treating cloud-init exit status 2 as error + - Fix to prevent sending refresh complete notification if snap snap- + refresh-observe interface is connected + - Fix to queue snapctl service commands if run from the default- + configure hook to ensure they get up-to-date config values + - Fix stop service failure when the service is not actually running + anymore + - Fix parsing /proc/PID/mounts with spaces + - Add registry interface that provides snaps access to a particular + registry view + - Add snap-interfaces-requests-control interface to enable prompting + client snaps + - steam-support interface: remove all AppArmor and seccomp + restrictions to improve user experience + - opengl interface: improve compatibility with nvidia drivers + - home interface: autoconnect home on Ubuntu Core Desktop + - serial-port interface: support RPMsg tty + - display-control interface: allow changing LVDS backlight power and + brightness + - power-control interface: support for battery charging thesholds, + type/status and AC type/status + - cpu-control interface: allow CPU C-state control + - raw-usb interface: support RPi5 and Thinkpad x13s + - custom-device interface: allow device file locking + - lxd-support interface: allow LXD to self-manage its own cgroup + - network-manager interface: support MPTCP sockets + - network-control interface: allow plug/slot access to gnutls config + and systemd resolved cache flushing via D-Bus + - network-control interface: allow wpa_supplicant dbus api + - gpio-control interface: support gpiochip* devices + - polkit interface: fix "rw" mount option check + - u2f-devices interface: enable additional security keys + - desktop interface: enable kde theming support + * Mon Jul 29 2024 Miroslav Suchý - 2.63-3 - convert license to SPDX * Fri Jul 26 2024 Miroslav Suchý - 2.63-2 - convert license to SPDX +* Wed Jul 24 2024 Ernest Lotter +- New upstream release 2.64 + - Support building snapd using base Core22 (Snapcraft 8.x) + - FIPS: support building FIPS complaint snapd variant that switches + to FIPS mode when the system boots with FIPS enabled + - AppArmor: update to AppArmor 4.0.1 + - AppArmor: support AppArmor snippet priorities + - AppArmor prompting: add checks for prompting support, include + prompting status in system key, and restart snapd if prompting + flag changes + - AppArmor prompting: include prompt prefix in AppArmor rules if + prompting is supported and enabled + - AppArmor prompting: add common types, constraints, and mappings + from AppArmor permissions to abstract permissions + - AppArmor prompting: add path pattern parsing and matching + - Registry views (experimental): rename from aspects to registries + - Registry views (experimental): support reading registry views + using snapctl + - Registry views (experimental): restrict view paths from using a + number as first character and view names to storage path style + patterns + - Snap components: support installing snaps and components from + files at the same time (no REST API/CLI) + - Snap components: support downloading components related assertions + from the store + - Snap components: support installing components from the store (no + REST API/CLI) + - Snap components: support removing components (REST API, no CLI) + - Snap components: started support for component hooks + - Snap components: support kernel modules as components + - Refresh app awareness (experimental): add data field for + /v2/changes REST API to allow associating each task with affected + snaps + - Refresh app awareness (experimental): use the app name from + .desktop file in notifications + - Refresh app awareness (experimental): give snap-refresh-observe + interface access to /v2/snaps/{name} endpoint + - Allow re-exec when SNAP_REEXEC is set for unlisted distros to + simplify testing + - Generate GNU build ID for Go binaries + - Add missing etelpmoc.sh for shell completion + - Do not attempt to run snapd on classic when re-exec is disabled + - Packaging/build maintenance for Debian sid, Fedora, Arch, openSuse + - Add snap debug api command to enable running raw queries + - Enable snap-confine snap mount directory detection + - Replace global seccomp filter with deny rules in standard seccomp + template + - Remove support for Ubuntu Core Launcher (superseded by snap- + confine) + - Support creating pending serial bound users after serial assertion + becomes available + - Support disabling cloud-init using kernel command-line + - In hybrid systems, apps can refresh without waiting for restarts + required by essential snaps + - Ship snap-debug-info.sh script used for system diagnostics + - Improve error messages when attempting to run non-existent snap + - Switch to -u UID:GID for strace-static + - Support enabling snapd logging with snap set system + debug.snapd.{log,log-level} + - Fix restarting activated services instead of their activator units + (i.e. sockets, timers) + - Fix potential unexpected auto-refresh of snap on managed schedule + - Fix potential segfault by guarding against kernel command-line + changes on classic system + - Fix proxy entries in /etc/environment with missing newline that + caused later manual entries to not be usable + - Fix offline remodelling by ignoring prerequisites that will + otherwise be downloaded from store + - Fix devmode seccomp deny regression that caused spamming the log + instead of actual denies + - Fix snap lock leak during refresh + - Fix not re-pinning validation sets that were already pinned when + enforcing new validation sets + - Fix handling of unexpected snapd runtime failure + - Fix /v2/notices REST API skipping notices with duplicate + timestamps + - Fix comparing systemd versions that may contain pre-release + suffixes + - Fix udev potentially starting before snap-device-helper is made + available + - Fix race in snap seed metadata loading + - Fix treating cloud-init exit status 2 as error + - Fix to prevent sending refresh complete notification if snap snap- + refresh-observe interface is connected + - Fix to queue snapctl service commands if run from the default- + configure hook to ensure they get up-to-date config values + - Fix stop service failure when the service is not actually running + anymore + - Add registry interface that provides snaps access to a particular + registry view + - steam-support interface: relaxed AppArmor and seccomp restrictions + to improve user experience + - home interface: autoconnect home on Ubuntu Core Desktop + - serial-port interface: support RPMsg tty + - display-control interface: allow changing LVDS backlight power and + brightness + - power-control interface: support for battery charging thesholds, + type/status and AC type/status + - cpu-control interface: allow CPU C-state control + - raw-usb interface: support RPi5 and Thinkpad x13s + - custom-device interface: allow device file locking + - lxd-support interface: allow LXD to self-manage its own cgroup + - network-manager interface: support MPTCP sockets + - network-control interface: allow plug/slot access to gnutls config + and systemd resolved cache flushing via D-Bus + * Sat Jul 20 2024 Fedora Release Engineering - 2.63-1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild diff --git a/sources b/sources index 569bfcb..9a60117 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (snapd_2.63.no-vendor.tar.xz) = 5973b7922f2caf1d4b0bc0db4fe5564134b04d6ca3b52204e9963b584bd80a91789c46902840169f9a8b1b1184820c86902401f585915ca06a010d81a2d9a453 -SHA512 (snapd_2.63.only-vendor.tar.xz) = 3ff9b8610c01997935b720e883644597f7d397a9a7b7e23eadbe95a67f62564e9d4d836c5667e39f95ed073115b106d58e5f4107f229c72014433414168baaa7 +SHA512 (snapd_2.65.1.no-vendor.tar.xz) = 32dccd0f9beab5303a3c58dd4a466cf700eef1674d9ecd1dacd8eda13e0984215c2956c2ef08d83f6b5e41d89dcd7b08e55a8bedf22b2aa9b652b3570a451eec +SHA512 (snapd_2.65.1.only-vendor.tar.xz) = 6ca83fb3bbef21b75a43c73a1e9fde172165198869847b52d5b34c8c23c332bbe2eabd90101a44f4f7d889fe10c17b2a571a8a5a5b65dab46c26233b3757a454 From 5d25d758dbb194041e637562e8e3b3739614a46e Mon Sep 17 00:00:00 2001 From: Zygmunt Krynicki Date: Fri, 25 Oct 2024 12:13:23 +0200 Subject: [PATCH 16/35] Cherry pick fix for SELinux timedatex problem from upstream Signed-off-by: Zygmunt Krynicki --- 0001-data-selinux-remove-timedatex.patch | 46 ++++++++++++++++++++++++ snapd.spec | 6 ++-- 2 files changed, 50 insertions(+), 2 deletions(-) create mode 100644 0001-data-selinux-remove-timedatex.patch diff --git a/0001-data-selinux-remove-timedatex.patch b/0001-data-selinux-remove-timedatex.patch new file mode 100644 index 0000000..a82c392 --- /dev/null +++ b/0001-data-selinux-remove-timedatex.patch @@ -0,0 +1,46 @@ +From 794cbbe80e2487be9ce967e08d2898640cd519cb Mon Sep 17 00:00:00 2001 +From: Maciej Borzecki +Date: Thu, 24 Oct 2024 16:03:03 +0200 +Subject: [PATCH] data/selinux: remove timedatex + +The upstream selinux-policy has dropped timedatex in +https://github.com/fedora-selinux/selinux-policy/commit/2246d17b3c63df73e3359161a9c4e9c07d1cd523 +Even when referencing type that no longer exists, our SELinux module +builds fine, but then cannot be loaded at runtime: + +maciek@localhost:~/snapd/data/selinux$ sudo semodule -i snappy.pp.bz2 +Failed to resolve typeattributeset statement at /var/lib/selinux/targeted/tmp/modules/400/snappy/cil:223 +Failed to resolve AST +semodule: Failed! + +And the offending line is: + +maciek@localhost:~/snapd/data/selinux$ /usr/libexec/selinux/hll/pp snappy.pp | tail -n +223 | head -1 +(typeattributeset cil_gen_require timedatex_t) + +Fixes: https://bugs.launchpad.net/snapd/+bug/2085535 + +Signed-off-by: Maciej Borzecki +--- + data/selinux/snappy.te | 5 ----- + 1 file changed, 5 deletions(-) + +diff --git a/data/selinux/snappy.te b/data/selinux/snappy.te +index 0862985aab..7dd9711fcc 100644 +--- a/data/selinux/snappy.te ++++ b/data/selinux/snappy.te +@@ -345,11 +345,6 @@ optional_policy(` + allow snappy_t systemd_timedated_t:dbus send_msg; + allow systemd_timedated_t snappy_t:dbus send_msg; + ') +-# or on some systems same dbus API may be provided by timedatex +-# RHEL7: there is no timedatex.if +-ifndef(`distro_rhel7',` +- timedatex_dbus_chat(snappy_t) +-') + + # kernel-module-load interface may inspect or write files under /etc/modprobe.d + optional_policy(` +-- +2.47.0 + diff --git a/snapd.spec b/snapd.spec index f336734..5965f2e 100644 --- a/snapd.spec +++ b/snapd.spec @@ -84,7 +84,7 @@ Name: snapd Version: 2.65.1 -Release: 0%{?dist} +Release: 1%{?dist} Summary: A transactional software package manager License: GPL-3.0-only URL: https://%{provider_prefix} @@ -934,8 +934,10 @@ if [ $1 -eq 0 ]; then %selinux_relabel_post fi - %changelog +* Thu Oct 25 2024 Zygmunt Krynicki +- Cherry pick fix for SELinux timedatex problem from upstream + * Sat Aug 24 2024 Ernest Lotter - New upstream release 2.65.1 - Support building snapd using base Core22 (Snapcraft 8.x) From 4ba07750b12e16c84b1a9fac7380c94c4984559e Mon Sep 17 00:00:00 2001 From: Zygmunt Krynicki Date: Fri, 25 Oct 2024 12:27:26 +0200 Subject: [PATCH 17/35] Fix the changelog date Signed-off-by: Zygmunt Krynicki --- snapd.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/snapd.spec b/snapd.spec index 5965f2e..88ec344 100644 --- a/snapd.spec +++ b/snapd.spec @@ -935,7 +935,7 @@ if [ $1 -eq 0 ]; then fi %changelog -* Thu Oct 25 2024 Zygmunt Krynicki +* Fri Oct 25 2024 Zygmunt Krynicki - Cherry pick fix for SELinux timedatex problem from upstream * Sat Aug 24 2024 Ernest Lotter From 5cad817975e19a79e6ab66dda58e4879fac0f459 Mon Sep 17 00:00:00 2001 From: Zygmunt Krynicki Date: Sat, 26 Oct 2024 18:42:02 +0200 Subject: [PATCH 18/35] Actually refer to the patch, oops Signed-off-by: Zygmunt Krynicki --- snapd.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/snapd.spec b/snapd.spec index 88ec344..7a88fea 100644 --- a/snapd.spec +++ b/snapd.spec @@ -90,6 +90,7 @@ License: GPL-3.0-only URL: https://%{provider_prefix} Source0: https://%{provider_prefix}/releases/download/%{version}/%{name}_%{version}.no-vendor.tar.xz Source1: https://%{provider_prefix}/releases/download/%{version}/%{name}_%{version}.only-vendor.tar.xz +Patch0: 0001-data-selinux-remove-timedatex.patch ExclusiveArch: %{?golang_arches}%{!?golang_arches:%{ix86} x86_64 %{arm} aarch64 ppc64le s390x} From ce1d099551437bab811df4bf36f25751e33e7144 Mon Sep 17 00:00:00 2001 From: Zygmunt Krynicki Date: Sat, 26 Oct 2024 18:42:02 +0200 Subject: [PATCH 19/35] Actually refer to the patch, oops Signed-off-by: Zygmunt Krynicki --- snapd.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/snapd.spec b/snapd.spec index 88ec344..7a88fea 100644 --- a/snapd.spec +++ b/snapd.spec @@ -90,6 +90,7 @@ License: GPL-3.0-only URL: https://%{provider_prefix} Source0: https://%{provider_prefix}/releases/download/%{version}/%{name}_%{version}.no-vendor.tar.xz Source1: https://%{provider_prefix}/releases/download/%{version}/%{name}_%{version}.only-vendor.tar.xz +Patch0: 0001-data-selinux-remove-timedatex.patch ExclusiveArch: %{?golang_arches}%{!?golang_arches:%{ix86} x86_64 %{arm} aarch64 ppc64le s390x} From 7b9dd1f5885e988f78c36471e11a364ab915a813 Mon Sep 17 00:00:00 2001 From: Zygmunt Krynicki Date: Sat, 26 Oct 2024 18:51:58 +0200 Subject: [PATCH 20/35] Bump release number to 2 Signed-off-by: Zygmunt Krynicki --- snapd.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/snapd.spec b/snapd.spec index 7a88fea..e79c636 100644 --- a/snapd.spec +++ b/snapd.spec @@ -84,7 +84,7 @@ Name: snapd Version: 2.65.1 -Release: 1%{?dist} +Release: 2%{?dist} Summary: A transactional software package manager License: GPL-3.0-only URL: https://%{provider_prefix} From cfab6fe4030559cec33e39662fb775b5633e29e3 Mon Sep 17 00:00:00 2001 From: Zygmunt Krynicki Date: Wed, 20 Nov 2024 13:02:55 +0100 Subject: [PATCH 21/35] Update to 2.66.1 Drop patch applied upstream. Signed-off-by: Zygmunt Krynicki --- .gitignore | 2 + 0001-data-selinux-remove-timedatex.patch | 46 ---------- snapd.spec | 103 ++++++++++++++++++++++- sources | 4 +- 4 files changed, 104 insertions(+), 51 deletions(-) delete mode 100644 0001-data-selinux-remove-timedatex.patch diff --git a/.gitignore b/.gitignore index 2e14c48..8f9c117 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,4 @@ /snapd_2.65.1.no-vendor.tar.xz /snapd_2.65.1.only-vendor.tar.xz +/snapd_2.66.1.no-vendor.tar.xz +/snapd_2.66.1.only-vendor.tar.xz diff --git a/0001-data-selinux-remove-timedatex.patch b/0001-data-selinux-remove-timedatex.patch deleted file mode 100644 index a82c392..0000000 --- a/0001-data-selinux-remove-timedatex.patch +++ /dev/null @@ -1,46 +0,0 @@ -From 794cbbe80e2487be9ce967e08d2898640cd519cb Mon Sep 17 00:00:00 2001 -From: Maciej Borzecki -Date: Thu, 24 Oct 2024 16:03:03 +0200 -Subject: [PATCH] data/selinux: remove timedatex - -The upstream selinux-policy has dropped timedatex in -https://github.com/fedora-selinux/selinux-policy/commit/2246d17b3c63df73e3359161a9c4e9c07d1cd523 -Even when referencing type that no longer exists, our SELinux module -builds fine, but then cannot be loaded at runtime: - -maciek@localhost:~/snapd/data/selinux$ sudo semodule -i snappy.pp.bz2 -Failed to resolve typeattributeset statement at /var/lib/selinux/targeted/tmp/modules/400/snappy/cil:223 -Failed to resolve AST -semodule: Failed! - -And the offending line is: - -maciek@localhost:~/snapd/data/selinux$ /usr/libexec/selinux/hll/pp snappy.pp | tail -n +223 | head -1 -(typeattributeset cil_gen_require timedatex_t) - -Fixes: https://bugs.launchpad.net/snapd/+bug/2085535 - -Signed-off-by: Maciej Borzecki ---- - data/selinux/snappy.te | 5 ----- - 1 file changed, 5 deletions(-) - -diff --git a/data/selinux/snappy.te b/data/selinux/snappy.te -index 0862985aab..7dd9711fcc 100644 ---- a/data/selinux/snappy.te -+++ b/data/selinux/snappy.te -@@ -345,11 +345,6 @@ optional_policy(` - allow snappy_t systemd_timedated_t:dbus send_msg; - allow systemd_timedated_t snappy_t:dbus send_msg; - ') --# or on some systems same dbus API may be provided by timedatex --# RHEL7: there is no timedatex.if --ifndef(`distro_rhel7',` -- timedatex_dbus_chat(snappy_t) --') - - # kernel-module-load interface may inspect or write files under /etc/modprobe.d - optional_policy(` --- -2.47.0 - diff --git a/snapd.spec b/snapd.spec index e79c636..b314752 100644 --- a/snapd.spec +++ b/snapd.spec @@ -83,14 +83,13 @@ %{!?_tmpfilesdir: %global _tmpfilesdir %{_prefix}/lib/tmpfiles.d} Name: snapd -Version: 2.65.1 -Release: 2%{?dist} +Version: 2.66.1 +Release: 0%{?dist} Summary: A transactional software package manager License: GPL-3.0-only URL: https://%{provider_prefix} Source0: https://%{provider_prefix}/releases/download/%{version}/%{name}_%{version}.no-vendor.tar.xz Source1: https://%{provider_prefix}/releases/download/%{version}/%{name}_%{version}.only-vendor.tar.xz -Patch0: 0001-data-selinux-remove-timedatex.patch ExclusiveArch: %{?golang_arches}%{!?golang_arches:%{ix86} x86_64 %{arm} aarch64 ppc64le s390x} @@ -936,9 +935,107 @@ if [ $1 -eq 0 ]; then fi %changelog +* Wed Nov 20 2024 Zygmunt Krynicki +- Drop only patch, applied upstream. + * Fri Oct 25 2024 Zygmunt Krynicki - Cherry pick fix for SELinux timedatex problem from upstream +* Fri Oct 11 2024 Ernest Lotter +- New upstream release 2.66.1 + - AppArmor prompting (experimental): Fix kernel prompting support + check + - Allow kernel snaps to have content slots + - Fix ignoring snaps in try mode when amending + +* Fri Oct 04 2024 Ernest Lotter +- New upstream release 2.66 + - AppArmor prompting (experimental): expand kernel support checks + - AppArmor prompting (experimental): consolidate error messages and + add error kinds + - AppArmor prompting (experimental): grant /v2/snaps/{name} via + snap-interfaces-requests-control + - AppArmor prompting (experimental): add checks for duplicate + pattern variants + - Registry views (experimental): add handlers that commit (and + cleanup) registry transactions + - Registry views (experimental): add a snapctl fail command for + rejecting registry transactions + - Registry views (experimental): allow custodian snaps to implement + registry hooks that modify and save registry data + - Registry views (experimental): run view-changed hooks only for + snaps plugging views affected by modified paths + - Registry views (experimental): make registry transactions + serialisable + - Snap components: handle refreshing components to revisions that + have been on the system before + - Snap components: enable creating Ubuntu Core images that contain + components + - Snap components: handle refreshing components independently of + snaps + - Snap components: handle removing components when refreshing a snap + that no longer defines them + - Snap components: extend snapd Ubuntu Core installation API to + allow for picking optional snaps and components to install + - Snap components: extend kernel.yaml with "dynamic-modules", + allowing kernel to define a location for kmods from component + hooks + - Snap components: renamed component type "test" to "standard" + - Desktop IDs: support installing desktop files with custom names + based on desktop-file-ids desktop interface plug attr + - Auto-install snapd on classic systems as prerequisite for any non- + essential snap install + - Support loading AppArmor profiles on WSL2 with non-default kernel + and securityfs mounted + - Debian/Fedora packaging updates + - Add snap debug command for investigating execution aspects of the + snap toolchain + - Improve snap pack error for easier parsing + - Add support for user services when refreshing snaps + - Add snap remove --terminate flag for terminating running snap + processes + - Support building FIPS complaint snapd deb and snap + - Fix to not use nss when looking up for users/groups from snapd + snap + - Fix ordering in which layout changes are saved + - Patch snapd snap dynamic linker to ignore LD_LIBRARY_PATH and + related variables + - Fix libexec dir for openSUSE Slowroll + - Fix handling of the shared snap directory for parallel installs + - Allow writing to /run/systemd/journal/dev-log by default + - Avoid state lock during snap removal to avoid delaying other snapd + operations + - Add nomad-support interface to enable running Hashicorp Nomad + - Add intel-qat interface + - u2f-devices interface: add u2f trustkey t120 product id and fx + series fido u2f devices + - desktop interface: improve integration with xdg-desktop-portal + - desktop interface: add desktop-file-ids plug attr to desktop + interface + - unity7 interface: support desktop-file-ids in desktop files rule + generation + - desktop-legacy interface: support desktop-file-ids in desktop + files rule generation + - desktop-legacy interface: grant access to gcin socket location + - login-session-observe interface: allow introspection + - custom-device interface: allow to explicitly identify matching + device in udev tagging block + - system-packages-doc interface: allow reading /usr/share/javascript + - modem-manager interface: add new format of WWAN ports + - pcscd interface: allow pcscd to read opensc.conf + - cpu-control interface: add IRQ affinity control to cpu_control + - opengl interface: add support for cuda workloads on Tegra iGPU in + opengl interface + +* Thu Sep 12 2024 Ernest Lotter +- New upstream release 2.65.3 + - Fix missing aux info from store on snap setup + +* Fri Sep 06 2024 Ernest Lotter +- New upstream release 2.65.2 + - Bump squashfuse from version 0.5.0 to 0.5.2 (used in snapd deb + only) + * Sat Aug 24 2024 Ernest Lotter - New upstream release 2.65.1 - Support building snapd using base Core22 (Snapcraft 8.x) diff --git a/sources b/sources index 9a60117..cafb463 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (snapd_2.65.1.no-vendor.tar.xz) = 32dccd0f9beab5303a3c58dd4a466cf700eef1674d9ecd1dacd8eda13e0984215c2956c2ef08d83f6b5e41d89dcd7b08e55a8bedf22b2aa9b652b3570a451eec -SHA512 (snapd_2.65.1.only-vendor.tar.xz) = 6ca83fb3bbef21b75a43c73a1e9fde172165198869847b52d5b34c8c23c332bbe2eabd90101a44f4f7d889fe10c17b2a571a8a5a5b65dab46c26233b3757a454 +SHA512 (snapd_2.66.1.no-vendor.tar.xz) = 96f99b334ee8eab5498515dd17757e69f221d9916f3dd58100714d0dd99ef25725986c714f98d7cd8ac53b540031c4cca55eeabd10dd2ceb734c3638c2703b08 +SHA512 (snapd_2.66.1.only-vendor.tar.xz) = 71a0a07e0c980a7dc4c0bb4ef5bdefe04e8224db875c0d287b8711042605522135829c33f4d9d728bab3721712161182814205ac132510d81189a09a631eafae From 397e94b9bad230d87ee7eba20212abb1fa9033f5 Mon Sep 17 00:00:00 2001 From: Zygmunt Krynicki Date: Fri, 29 Nov 2024 19:53:36 +0100 Subject: [PATCH 22/35] Re-cherry pick fix for SELinux timedatex problem Signed-off-by: Zygmunt Krynicki --- 0001-data-selinux-remove-timedatex.patch | 46 ++++++++++++++++++++++++ snapd.spec | 7 +++- 2 files changed, 52 insertions(+), 1 deletion(-) create mode 100644 0001-data-selinux-remove-timedatex.patch diff --git a/0001-data-selinux-remove-timedatex.patch b/0001-data-selinux-remove-timedatex.patch new file mode 100644 index 0000000..a82c392 --- /dev/null +++ b/0001-data-selinux-remove-timedatex.patch @@ -0,0 +1,46 @@ +From 794cbbe80e2487be9ce967e08d2898640cd519cb Mon Sep 17 00:00:00 2001 +From: Maciej Borzecki +Date: Thu, 24 Oct 2024 16:03:03 +0200 +Subject: [PATCH] data/selinux: remove timedatex + +The upstream selinux-policy has dropped timedatex in +https://github.com/fedora-selinux/selinux-policy/commit/2246d17b3c63df73e3359161a9c4e9c07d1cd523 +Even when referencing type that no longer exists, our SELinux module +builds fine, but then cannot be loaded at runtime: + +maciek@localhost:~/snapd/data/selinux$ sudo semodule -i snappy.pp.bz2 +Failed to resolve typeattributeset statement at /var/lib/selinux/targeted/tmp/modules/400/snappy/cil:223 +Failed to resolve AST +semodule: Failed! + +And the offending line is: + +maciek@localhost:~/snapd/data/selinux$ /usr/libexec/selinux/hll/pp snappy.pp | tail -n +223 | head -1 +(typeattributeset cil_gen_require timedatex_t) + +Fixes: https://bugs.launchpad.net/snapd/+bug/2085535 + +Signed-off-by: Maciej Borzecki +--- + data/selinux/snappy.te | 5 ----- + 1 file changed, 5 deletions(-) + +diff --git a/data/selinux/snappy.te b/data/selinux/snappy.te +index 0862985aab..7dd9711fcc 100644 +--- a/data/selinux/snappy.te ++++ b/data/selinux/snappy.te +@@ -345,11 +345,6 @@ optional_policy(` + allow snappy_t systemd_timedated_t:dbus send_msg; + allow systemd_timedated_t snappy_t:dbus send_msg; + ') +-# or on some systems same dbus API may be provided by timedatex +-# RHEL7: there is no timedatex.if +-ifndef(`distro_rhel7',` +- timedatex_dbus_chat(snappy_t) +-') + + # kernel-module-load interface may inspect or write files under /etc/modprobe.d + optional_policy(` +-- +2.47.0 + diff --git a/snapd.spec b/snapd.spec index b314752..3533d20 100644 --- a/snapd.spec +++ b/snapd.spec @@ -84,12 +84,13 @@ Name: snapd Version: 2.66.1 -Release: 0%{?dist} +Release: 1%{?dist} Summary: A transactional software package manager License: GPL-3.0-only URL: https://%{provider_prefix} Source0: https://%{provider_prefix}/releases/download/%{version}/%{name}_%{version}.no-vendor.tar.xz Source1: https://%{provider_prefix}/releases/download/%{version}/%{name}_%{version}.only-vendor.tar.xz +Patch0: 0001-data-selinux-remove-timedatex.patch ExclusiveArch: %{?golang_arches}%{!?golang_arches:%{ix86} x86_64 %{arm} aarch64 ppc64le s390x} @@ -935,6 +936,10 @@ if [ $1 -eq 0 ]; then fi %changelog +* Fri Nov 29 2024 Zygmunt Krynicki +- Re-cherry pick fix for SELinux timedatex problem from upstream + as it was not released in 2.66.1, sorry. + * Wed Nov 20 2024 Zygmunt Krynicki - Drop only patch, applied upstream. From 908b6b7349972ae19c7cd810d2bfe1e1dfa0b221 Mon Sep 17 00:00:00 2001 From: Orion Poplawski Date: Tue, 3 Dec 2024 09:04:20 -0700 Subject: [PATCH 23/35] Drop RestartMode from snapd.service on EL8 (rhbz#2315759) --- snapd.spec | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/snapd.spec b/snapd.spec index 3533d20..37ee589 100644 --- a/snapd.spec +++ b/snapd.spec @@ -84,7 +84,7 @@ Name: snapd Version: 2.66.1 -Release: 1%{?dist} +Release: 2%{?dist} Summary: A transactional software package manager License: GPL-3.0-only URL: https://%{provider_prefix} @@ -484,6 +484,11 @@ rm -rf vendor/* %endif # Apply patches %autopatch -p1 +# systemd on EL8 does not recognize RestartMode +# https://bugzilla.redhat.com/show_bug.cgi?id=2315759 +%if 0%{?el8} +sed -i -e '/^RestartMode=/d' data/systemd/snapd.service.in +%endif %build @@ -936,6 +941,9 @@ if [ $1 -eq 0 ]; then fi %changelog +* Tue Dec 03 2024 Orion Poplawski +- Drop RestartMode from snapd.service on EL8 (rhbz#2315759) + * Fri Nov 29 2024 Zygmunt Krynicki - Re-cherry pick fix for SELinux timedatex problem from upstream as it was not released in 2.66.1, sorry. From 11b4978ff53530ca27e725fba08c5b8ccbcf56c3 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sun, 19 Jan 2025 11:05:17 +0000 Subject: [PATCH 24/35] Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild --- snapd.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/snapd.spec b/snapd.spec index 37ee589..d9d9677 100644 --- a/snapd.spec +++ b/snapd.spec @@ -84,7 +84,7 @@ Name: snapd Version: 2.66.1 -Release: 2%{?dist} +Release: 3%{?dist} Summary: A transactional software package manager License: GPL-3.0-only URL: https://%{provider_prefix} @@ -941,6 +941,9 @@ if [ $1 -eq 0 ]; then fi %changelog +* Sun Jan 19 2025 Fedora Release Engineering - 2.66.1-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild + * Tue Dec 03 2024 Orion Poplawski - Drop RestartMode from snapd.service on EL8 (rhbz#2315759) From b3caa4d90a72e33192ad5938b3a6b86ea303a308 Mon Sep 17 00:00:00 2001 From: Zygmunt Krynicki Date: Wed, 22 Jan 2025 10:37:31 +0100 Subject: [PATCH 25/35] New upstream release 2.67 --- .gitignore | 6 +- 0001-data-selinux-remove-timedatex.patch | 46 ------------- snapd.spec | 85 +++++++++++++++++++++++- sources | 4 +- 4 files changed, 86 insertions(+), 55 deletions(-) delete mode 100644 0001-data-selinux-remove-timedatex.patch diff --git a/.gitignore b/.gitignore index 8f9c117..6d215bd 100644 --- a/.gitignore +++ b/.gitignore @@ -1,4 +1,2 @@ -/snapd_2.65.1.no-vendor.tar.xz -/snapd_2.65.1.only-vendor.tar.xz -/snapd_2.66.1.no-vendor.tar.xz -/snapd_2.66.1.only-vendor.tar.xz +/snapd_2.67.no-vendor.tar.xz +/snapd_2.67.only-vendor.tar.xz diff --git a/0001-data-selinux-remove-timedatex.patch b/0001-data-selinux-remove-timedatex.patch deleted file mode 100644 index a82c392..0000000 --- a/0001-data-selinux-remove-timedatex.patch +++ /dev/null @@ -1,46 +0,0 @@ -From 794cbbe80e2487be9ce967e08d2898640cd519cb Mon Sep 17 00:00:00 2001 -From: Maciej Borzecki -Date: Thu, 24 Oct 2024 16:03:03 +0200 -Subject: [PATCH] data/selinux: remove timedatex - -The upstream selinux-policy has dropped timedatex in -https://github.com/fedora-selinux/selinux-policy/commit/2246d17b3c63df73e3359161a9c4e9c07d1cd523 -Even when referencing type that no longer exists, our SELinux module -builds fine, but then cannot be loaded at runtime: - -maciek@localhost:~/snapd/data/selinux$ sudo semodule -i snappy.pp.bz2 -Failed to resolve typeattributeset statement at /var/lib/selinux/targeted/tmp/modules/400/snappy/cil:223 -Failed to resolve AST -semodule: Failed! - -And the offending line is: - -maciek@localhost:~/snapd/data/selinux$ /usr/libexec/selinux/hll/pp snappy.pp | tail -n +223 | head -1 -(typeattributeset cil_gen_require timedatex_t) - -Fixes: https://bugs.launchpad.net/snapd/+bug/2085535 - -Signed-off-by: Maciej Borzecki ---- - data/selinux/snappy.te | 5 ----- - 1 file changed, 5 deletions(-) - -diff --git a/data/selinux/snappy.te b/data/selinux/snappy.te -index 0862985aab..7dd9711fcc 100644 ---- a/data/selinux/snappy.te -+++ b/data/selinux/snappy.te -@@ -345,11 +345,6 @@ optional_policy(` - allow snappy_t systemd_timedated_t:dbus send_msg; - allow systemd_timedated_t snappy_t:dbus send_msg; - ') --# or on some systems same dbus API may be provided by timedatex --# RHEL7: there is no timedatex.if --ifndef(`distro_rhel7',` -- timedatex_dbus_chat(snappy_t) --') - - # kernel-module-load interface may inspect or write files under /etc/modprobe.d - optional_policy(` --- -2.47.0 - diff --git a/snapd.spec b/snapd.spec index d9d9677..5f43183 100644 --- a/snapd.spec +++ b/snapd.spec @@ -83,14 +83,13 @@ %{!?_tmpfilesdir: %global _tmpfilesdir %{_prefix}/lib/tmpfiles.d} Name: snapd -Version: 2.66.1 -Release: 3%{?dist} +Version: 2.67 +Release: 0%{?dist} Summary: A transactional software package manager License: GPL-3.0-only URL: https://%{provider_prefix} Source0: https://%{provider_prefix}/releases/download/%{version}/%{name}_%{version}.no-vendor.tar.xz Source1: https://%{provider_prefix}/releases/download/%{version}/%{name}_%{version}.only-vendor.tar.xz -Patch0: 0001-data-selinux-remove-timedatex.patch ExclusiveArch: %{?golang_arches}%{!?golang_arches:%{ix86} x86_64 %{arm} aarch64 ppc64le s390x} @@ -941,6 +940,86 @@ if [ $1 -eq 0 ]; then fi %changelog +* Wed Jan 22 2025 Zygmunt Krynicki +- The changelog date and author have been modified to maintain linearity. +- Drop 0001-data-selinux-remove-timedatex.patch - applied upstream. +- New upstream release 2.67 + - AppArmor prompting (experimental): allow overlapping rules + - Registry view (experimental): Changes to registry data (from both + users and snaps) can be validated and saved by custodian snaps + - Registry view (experimental): Support 'snapctl get --pristine' to + read the registry data excluding staged transaction changes + - Registry view (experimental): Put registry commands behind + experimental feature flag + - Components: Make modules shipped/created by kernel-modules + components available right after reboot + - Components: Add tab completion for local component files + - Components: Allow installing snaps and components from local files + jointly on the CLI + - Components: Allow 'snapctl model' command for gadget and kernel + snaps + - Components: Add 'snap components' command + - Components: Bug fixes + - eMMC gadget updates (WIP): add syntax support in gadget.yaml for + eMMC schema + - Support for ephemeral recovery mode on hybrid systems + - Support for dm-verity options in snap-bootstrap + - Support for overlayfs options and allow empty what argument for + tmpfs + - Enable ubuntu-image to determine the size of the disk image to + create + - Expose 'snap debug' commands 'validate-seed' and 'seeding' + - Add debug API option to use dedicated snap socket /run/snapd- + snap.socket + - Hide experimental features that are no longer required + (accepted/rejected) + - Mount ubuntu-save partition with no{exec,dev,suid} at install, run + and factory-reset + - Improve memory controller support with cgroup v2 + - Support ssh socket activation configurations (used by ubuntu + 22.10+) + - Fix generation of AppArmor profile with incorrect revision during + multi snap refresh + - Fix refresh app awareness related deadlock edge case + - Fix not caching delta updated snap download + - Fix passing non root uid, guid to initial tmpfs mount + - Fix ignoring snaps in try mode when amending + - Fix reloading of service activation units to avoid systemd errors + - Fix snapd snap FIPS build on Launchpad to use Advantage Pro FIPS + updates PPA + - Make killing of snap apps best effort to avoid possibility of + malicious failure loop + - Alleviate impact of auto-refresh failure loop with progressive + delay + - Dropped timedatex in selinux-policy to avoid runtime issue + - Fix missing syscalls in seccomp profile + - Modify AppArmor template to allow using SNAP_REEXEC on arch + systems + - Modify AppArmor template to allow using vim.tiny (available in + base snaps) + - Modify AppArmor template to add read-access to debian_version + - Modify AppArmor template to allow owner to read + @{PROC}/@{pid}/sessionid + - {common,personal,system}-files interface: prohibit trailing @ in + filepaths + - {desktop,shutdown,system-observe,upower-observe} interface: + improve for Ubuntu Core Desktop + - custom-device interface: allow @ in custom-device filepaths + - desktop interface: improve launch entry and systray integration + with session + - desktop-legacy interface: allow DBus access to + com.canonical.dbusmenu + - fwupd interface: allow access to nvmem for thunderbolt plugin + - mpris interface: add plasmashell as label + - mount-control interface: add support for nfs mounts + - network-{control,manager} interface: add missing dbus link rules + - network-manager-observe interface: add getDevices methods + - opengl interface: add Kernel Fusion Driver access to opengl + - screen-inhibit-control interface: improve screen inhibit control + for use on core + - udisks2 interface: allow ping of the UDisks2 service + - u2f-devices interface: add Nitrokey Passkey + * Sun Jan 19 2025 Fedora Release Engineering - 2.66.1-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild diff --git a/sources b/sources index cafb463..238e744 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (snapd_2.66.1.no-vendor.tar.xz) = 96f99b334ee8eab5498515dd17757e69f221d9916f3dd58100714d0dd99ef25725986c714f98d7cd8ac53b540031c4cca55eeabd10dd2ceb734c3638c2703b08 -SHA512 (snapd_2.66.1.only-vendor.tar.xz) = 71a0a07e0c980a7dc4c0bb4ef5bdefe04e8224db875c0d287b8711042605522135829c33f4d9d728bab3721712161182814205ac132510d81189a09a631eafae +SHA512 (snapd_2.67.no-vendor.tar.xz) = 517b8559edf2a1792f551ca4ccb3c1b026ea2f56b58c95c3cdaa4bdce690629dc9e917b388718b3c76d2fdf314ba6eaea16ba1c9fd8f910f3cb22880810aabb8 +SHA512 (snapd_2.67.only-vendor.tar.xz) = 56642733f89fe62a81081856eb878186d0bd6269af31aa453d65478934b4032dce1e04c8682d1164ad9a371f48da014cb5a5a6a27062cda27a93d6fe0541f4d5 From 6665271b359aae5fc088ea2caf7592d855038ff2 Mon Sep 17 00:00:00 2001 From: Zygmunt Krynicki Date: Tue, 25 Mar 2025 13:50:40 +0100 Subject: [PATCH 26/35] New upstream release 2.68.3 Signed-off-by: Zygmunt Krynicki --- .gitignore | 4 +- snapd.spec | 168 +++++++++++++++++++++++++++++++++++++++++++++++++++-- sources | 4 +- 3 files changed, 168 insertions(+), 8 deletions(-) diff --git a/.gitignore b/.gitignore index 6d215bd..1f4cd8b 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,2 @@ -/snapd_2.67.no-vendor.tar.xz -/snapd_2.67.only-vendor.tar.xz +/snapd_2.68.3.no-vendor.tar.xz +/snapd_2.68.3.only-vendor.tar.xz diff --git a/snapd.spec b/snapd.spec index 5f43183..8edbbef 100644 --- a/snapd.spec +++ b/snapd.spec @@ -83,7 +83,7 @@ %{!?_tmpfilesdir: %global _tmpfilesdir %{_prefix}/lib/tmpfiles.d} Name: snapd -Version: 2.67 +Version: 2.68.3 Release: 0%{?dist} Summary: A transactional software package manager License: GPL-3.0-only @@ -747,9 +747,9 @@ export GO111MODULE=off %endif # snap-confine tests (these always run!) -pushd ./cmd -make check -popd +make -C cmd -k check +# and data files +make -C data -k check %files #define license tag if not already defined @@ -940,6 +940,152 @@ if [ $1 -eq 0 ]; then fi %changelog +* Mon Mar 10 2025 Ernest Lotter +- New upstream release 2.68.3 + - FDE: LP: #2101834 snapd 2.68+ and snap-bootstrap <2.68 fallback to + old keyring path + - Fix Plucky snapd deb build issue related to /var/lib/snapd/void + permissions + - Fix snapd deb build complaint about ifneq with extra bracket + +* Thu Feb 27 2025 Ernest Lotter +- New upstream release 2.68.2 + - FDE: use boot mode for FDE hooks + - FDE: add snap-bootstrap compatibility check to prevent image + creation with incompatible snapd and kernel snap + - FDE: add argon2 out-of-process KDF support + - FDE: have separate mutex for the sections writing a fresh modeenv + - FDE: LP: #2099709 update secboot to e07f4ae48e98 + - Confdb: support pruning ephemeral data and process alternative + types in order + - core-initrd: look at env to mount directly to /sysroot + - core-initrd: prepare for Plucky build and split out 24.10 + (Oracular) + - Fix missing primed packages in snapd snap manifest + - Interfaces: posix-mq | fix incorrect clobbering of global variable + and make interface more precise + - Interfaces: opengl | add more kernel fusion driver files + +* Mon Feb 24 2025 Ernest Lotter +- New upstream release 2.68.1 + - Fix snap-confine type specifier type mismatch on armhf + +* Thu Feb 13 2025 Ernest Lotter +- New upstream release 2.68 + - FDE: add support for new and more extensible key format that is + unified between TPM and FDE hook + - FDE: add support for adding passphrases during installation + - FDE: update secboot to 30317622bbbc + - Snap components: make kernel components available on firstboot + after either initramfs or ephemeral rootfs style install + - Snap components: mount drivers tree from initramfs so kernel + modules are available in early boot stages + - Snap components: support remodeling to models that contain + components + - Snap components: support offline remodeling to models that contain + components + - Snap components: support creating new recovery systems with + components + - Snap components: support downloading components with 'snap + download' command + - Snap components: support sideloading asserted components + - AppArmor Prompting(experimental): improve version checks and + handling of listener notification protocol for communication with + kernel AppArmor + - AppArmor Prompting(experimental): make prompt replies idempotent, + and have at most one rule for any given path pattern, with + potentially mixed outcomes and lifespans + - AppArmor Prompting(experimental): timeout unresolved prompts after + a period of client inactivity + - AppArmor Prompting(experimental): return an error if a patch + request to the API would result in a rule without any permissions + - AppArmor Prompting(experimental): warn if there is no prompting + client present but prompting is enabled, or if a prompting-related + error occurs during snapd startup + - AppArmor Prompting(experimental): do not log error when converting + empty permissions to AppArmor permissions + - Confdb(experimental): rename registries to confdbs (including API + /v2/registries => /v2/confdb) + - Confdb(experimental): support marking confdb schemas as ephemeral + - Confdb(experimental): add confdb-control assertion and feature + flag + - Refresh App Awareness(experimental): LP: #2089195 prevent + possibility of incorrect notification that snap will quit and + update + - Confidential VMs: snap-bootstrap support for loading partition + information from a manifest file for cloudimg-rootfs mode + - Confidential VMs: snap-bootstrap support for setting up cloudimg- + rootfs as an overlayfs with integrity protection + - dm-verity for essential snaps: add support for snap-integrity + assertion + - Interfaces: modify AppArmor template to allow owner read on + @{PROC}/@{pid}/fdinfo/* + - Interfaces: LP: #2072987 modify AppArmor template to allow using + setpriv to run daemon as non-root user + - Interfaces: add configfiles backend that ensures the state of + configuration files in the filesystem + - Interfaces: add ldconfig backend that exposes libraries coming + from snaps to either the rootfs or to other snaps + - Interfaces: LP: #1712808 LP: 1865503 disable udev backend when + inside a container + - Interfaces: add auditd-support interface that grants audit_control + capability and required paths for auditd to function + - Interfaces: add checkbox-support interface that allows + unrestricted access to all devices + - Interfaces: fwupd | allow access to dell bios recovery + - Interfaces: fwupd | allow access to shim and fallback shim + - Interfaces: mount-control | add mount option validator to detect + mount option conflicts early + - Interfaces: cpu-control | add read access to /sys/kernel/irq/ + - Interfaces: locale-control | changed to be implicit on Ubuntu Core + Desktop + - Interfaces: microstack-support | support for utilizing of AMD SEV + capabilities + - Interfaces: u2f | added missing OneSpan device product IDs + - Interfaces: auditd-support | grant seccomp setpriority + - Interfaces: opengl interface | enable parsing of nvidia driver + information files + - Allow mksquashfs 'xattrs' when packing snap types os, core, base + and snapd as part of work to support non-root snap-confine + - Upstream/downstream packaging changes and build updates + - Improve error logs for malformed desktop files to also show which + desktop file is at fault + - Provide more precise error message when overriding channels with + grade during seed creation + - Expose 'snap prepare-image' validation parameter + - Add snap-seccomp 'dump' command that dumps the filter rules from a + compiled profile + - Add fallback release info location /etc/initrd-release + - Added core-initrd to snapd repo and fixed issues with ubuntu-core- + initramfs deb builds + - Remove stale robust-mount-namespace-updates experimental feature + flag + - Remove snapd-snap experimental feature (rejected) and it's feature + flag + - Changed snap-bootstrap to mount base directly on /sysroot + - Mount ubuntu-seed mounted as no-{suid,exec,dev} + - Mapping volumes to disks: add support for volume-assignments in + gadget + - Fix silently broken binaries produced by distro patchelf 0.14.3 by + using locally build patchelf 0.18 + - Fix mismatch between listed refresh candidates and actual refresh + due to outdated validation sets + - Fix 'snap get' to produce compact listing for tty + - Fix missing store-url by keeping it as part of auxiliary store + info + - Fix snap-confine attempting to retrieve device cgroup setup inside + container where it is not available + - Fix 'snap set' and 'snap get' panic on empty strings with early + error checking + - Fix logger debug entries to show correct caller and file + information + - Fix issue preventing hybrid systems from being seeded on first + boot + - LP: #1966203 remove auto-import udev rules not required by deb + package to avoid unwanted syslog errors + - LP: #1886414 fix progress reporting when stdout is on a tty, but + stdin is not + * Wed Jan 22 2025 Zygmunt Krynicki - The changelog date and author have been modified to maintain linearity. - Drop 0001-data-selinux-remove-timedatex.patch - applied upstream. @@ -1023,6 +1169,20 @@ fi * Sun Jan 19 2025 Fedora Release Engineering - 2.66.1-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild +* Wed Jan 15 2025 Ernest Lotter +- New upstream release 2.67.1 + - Fix apparmor permissions to allow snaps access to kernel modules + and firmware on UC24, which also fixes the kernel-modules-control + interface on UC24 + - AppArmor prompting (experimental): disallow /./ and /../ in path + patterns + - Fix 'snap run' getent based user lookup in case of bad PATH + - Fix snapd using the incorrect AppArmor version during undo of an + refresh for regenerating snap profiles + - Add new syscalls to base templates + - hardware-observe interface: allow riscv_hwprobe syscall + - mount-observe interface: allow listmount and statmount syscalls + * Tue Dec 03 2024 Orion Poplawski - Drop RestartMode from snapd.service on EL8 (rhbz#2315759) diff --git a/sources b/sources index 238e744..59677d6 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (snapd_2.67.no-vendor.tar.xz) = 517b8559edf2a1792f551ca4ccb3c1b026ea2f56b58c95c3cdaa4bdce690629dc9e917b388718b3c76d2fdf314ba6eaea16ba1c9fd8f910f3cb22880810aabb8 -SHA512 (snapd_2.67.only-vendor.tar.xz) = 56642733f89fe62a81081856eb878186d0bd6269af31aa453d65478934b4032dce1e04c8682d1164ad9a371f48da014cb5a5a6a27062cda27a93d6fe0541f4d5 +SHA512 (snapd_2.68.3.no-vendor.tar.xz) = 65039fb0fe515cfcdb2779d5c4b40b64612e9bd7fcc763ac8cd3ddd9efb26d4c7f0b6f58f9c80cec274bed5bfece8c94bad8645189a8a8534b73017e3848a97c +SHA512 (snapd_2.68.3.only-vendor.tar.xz) = b6f68082e4c5df6e957f9da0aec04638821e42629fd13b9660ad3986da9fcde70572c17213d754788408c260814f9369a5d00e212a7f6054918eec4eaa1299f3 From 1b8eb3321a2e7ff08503b88931e5a8f0b06347e0 Mon Sep 17 00:00:00 2001 From: Zygmunt Krynicki Date: Mon, 14 Jul 2025 13:41:14 +0200 Subject: [PATCH 27/35] New upstream release 2.70 Signed-off-by: Zygmunt Krynicki --- .gitignore | 4 +- snapd.spec | 226 +++++++++++++++++++++++++++++++++++++++++++++++------ sources | 4 +- 3 files changed, 208 insertions(+), 26 deletions(-) diff --git a/.gitignore b/.gitignore index 1f4cd8b..6db0575 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,2 @@ -/snapd_2.68.3.no-vendor.tar.xz -/snapd_2.68.3.only-vendor.tar.xz +/snapd_2.70.no-vendor.tar.xz +/snapd_2.70.only-vendor.tar.xz diff --git a/snapd.spec b/snapd.spec index 8edbbef..e53bd96 100644 --- a/snapd.spec +++ b/snapd.spec @@ -52,27 +52,27 @@ %global provider_prefix %{provider}.%{provider_tld}/%{project}/%{repo} %global import_path %{provider_prefix} -%global snappy_svcs snapd.service snapd.socket snapd.autoimport.service snapd.seeded.service snapd.mounts.target snapd.mounts-pre.target +%global snappy_svcs snapd.service snapd.socket snapd.autoimport.service snapd.seeded.service snapd.apparmor.service snapd.mounts.target snapd.mounts-pre.target %global snappy_user_svcs snapd.session-agent.service snapd.session-agent.socket # Until we have a way to add more extldflags to gobuild macro... # Always use external linking when building static binaries. %if 0%{?fedora} || 0%{?rhel} >= 8 -%define gobuild_static(o:) go build -buildmode pie -compiler gc -tags="rpm_crashtraceback ${BUILDTAGS:-}" -ldflags "-B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \\n') -linkmode external -extldflags '%__global_ldflags -static'" -a -v -x %{?**}; +%define gobuild_static(o:) go build -buildmode pie -compiler gc -tags="rpm_crashtraceback ${BUILDTAGS:-}" -ldflags "-B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \\n') -linkmode external -extldflags '%__global_ldflags -static'" -a -v %{?**}; %endif %if 0%{?rhel} == 7 # no pass PIE flags due to https://bugzilla.redhat.com/show_bug.cgi?id=1634486 -%define gobuild_static(o:) go build -compiler gc -tags="rpm_crashtraceback ${BUILDTAGS:-}" -ldflags "-B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \\n') -linkmode external -extldflags '%__global_ldflags -static'" -a -v -x %{?**}; +%define gobuild_static(o:) go build -compiler gc -tags="rpm_crashtraceback ${BUILDTAGS:-}" -ldflags "-B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \\n') -linkmode external -extldflags '%__global_ldflags -static'" -a -v %{?**}; %endif # These macros are missing BUILDTAGS in RHEL 8/9, see RHBZ#1825138 %if 0%{?rhel} >= 8 -%define gobuild(o:) go build -buildmode pie -compiler gc -tags="rpm_crashtraceback ${BUILDTAGS:-}" -ldflags "-B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \\n') -linkmode external -extldflags '%__global_ldflags'" -a -v -x %{?**}; +%define gobuild(o:) go build -buildmode pie -compiler gc -tags="rpm_crashtraceback ${BUILDTAGS:-}" -ldflags "-B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \\n') -linkmode external -extldflags '%__global_ldflags'" -a -v %{?**}; %endif # These macros are not defined in RHEL 7 %if 0%{?rhel} == 7 -%define gobuild(o:) go build -compiler gc -tags="rpm_crashtraceback ${BUILDTAGS:-}" -ldflags "-B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \\n') -linkmode external -extldflags '%__global_ldflags'" -a -v -x %{?**}; +%define gobuild(o:) go build -compiler gc -tags="rpm_crashtraceback ${BUILDTAGS:-}" -ldflags "-B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \\n') -linkmode external -extldflags '%__global_ldflags'" -a -v %{?**}; %define gotest() go test -compiler gc %{?**}; %endif @@ -83,8 +83,8 @@ %{!?_tmpfilesdir: %global _tmpfilesdir %{_prefix}/lib/tmpfiles.d} Name: snapd -Version: 2.68.3 -Release: 0%{?dist} +Version: 2.70 +Release: 1%{?dist} Summary: A transactional software package manager License: GPL-3.0-only URL: https://%{provider_prefix} @@ -135,8 +135,8 @@ Provides: %{name}-login-service%{?_isa} = 1.33 BuildRequires: golang(go.etcd.io/bbolt) BuildRequires: golang(github.com/bmatcuk/doublestar/v4) BuildRequires: golang(github.com/coreos/go-systemd/activation) -BuildRequires: golang(github.com/godbus/dbus) -BuildRequires: golang(github.com/godbus/dbus/introspect) +BuildRequires: golang(github.com/godbus/dbus/v5) +BuildRequires: golang(github.com/godbus/dbus/v5/introspect) BuildRequires: golang(github.com/gorilla/mux) BuildRequires: golang(github.com/jessevdk/go-flags) BuildRequires: golang(github.com/juju/ratelimit) @@ -229,8 +229,8 @@ BuildArch: noarch Requires: golang(go.etcd.io/bbolt) Requires: golang(github.com/bmatcuk/doublestar/v4) Requires: golang(github.com/coreos/go-systemd/activation) -Requires: golang(github.com/godbus/dbus) -Requires: golang(github.com/godbus/dbus/introspect) +Requires: golang(github.com/godbus/dbus/v5) +Requires: golang(github.com/godbus/dbus/v5/introspect) Requires: golang(github.com/gorilla/mux) Requires: golang(github.com/jessevdk/go-flags) Requires: golang(github.com/juju/ratelimit) @@ -259,8 +259,8 @@ Requires: golang(gopkg.in/yaml.v3) Provides: bundled(golang(go.etcd.io/bbolt)) Provides: bundled(golang(github.com/bmatcuk/doublestar/v4)) Provides: bundled(golang(github.com/coreos/go-systemd/activation)) -Provides: bundled(golang(github.com/godbus/dbus)) -Provides: bundled(golang(github.com/godbus/dbus/introspect)) +Provides: bundled(golang(github.com/godbus/dbus/v5)) +Provides: bundled(golang(github.com/godbus/dbus/v5/introspect)) Provides: bundled(golang(github.com/gorilla/mux)) Provides: bundled(golang(github.com/jessevdk/go-flags)) Provides: bundled(golang(github.com/juju/ratelimit)) @@ -507,7 +507,7 @@ export GO111MODULE=off # see https://github.com/gofed/go-macros/blob/master/rpm/macros.d/macros.go-compilers-golang BUILDTAGS= %if 0%{?with_test_keys} -BUILDTAGS="withtestkeys nosecboot" +BUILDTAGS="withtestkeys nosecboot structuredlogging" %else BUILDTAGS="nosecboot" %endif @@ -524,6 +524,7 @@ sed -e "s:github.com/snapcore/bolt:github.com/boltdb/bolt:g" -i advisor/*.go BUILDTAGS="${BUILDTAGS} nomanagers" %gobuild -o bin/snap $GOFLAGS %{import_path}/cmd/snap %gobuild -o bin/snap-failure $GOFLAGS %{import_path}/cmd/snap-failure +%gobuild -o bin/snapd-apparmor $GOFLAGS %{import_path}/cmd/snapd-apparmor # To ensure things work correctly with base snaps, # snap-exec, snap-update-ns, and snapctl need to be built statically @@ -561,7 +562,6 @@ BUILDTAGS="${BUILDTAGS} nomanagers" # Build snap-confine pushd ./cmd autoreconf --force --install --verbose -# FIXME: add --enable-caps-over-setuid as soon as possible (setuid discouraged!) %configure \ --disable-apparmor \ --enable-selinux \ @@ -628,6 +628,7 @@ install -p -m 0755 bin/snap-failure %{buildroot}%{_libexecdir}/snapd install -p -m 0755 bin/snapd %{buildroot}%{_libexecdir}/snapd install -p -m 0755 bin/snap-update-ns %{buildroot}%{_libexecdir}/snapd install -p -m 0755 bin/snap-seccomp %{buildroot}%{_libexecdir}/snapd +install -p -m 0755 bin/snapd-apparmor %{buildroot}%{_libexecdir}/snapd # Ensure /usr/bin/snapctl is a symlink to /usr/libexec/snapd/snapctl install -p -m 0755 bin/snapctl %{buildroot}%{_libexecdir}/snapd/snapctl ln -sf %{_libexecdir}/snapd/snapctl %{buildroot}%{_bindir}/snapctl @@ -684,12 +685,17 @@ rm -fv %{buildroot}%{_unitdir}/snapd.recovery-chooser-trigger.service rm %{buildroot}%{_libexecdir}/snapd/snapd.core-fixup.sh rm %{buildroot}%{_libexecdir}/snapd/system-shutdown -# Remove snapd apparmor service -rm -f %{buildroot}%{_unitdir}/snapd.apparmor.service -rm -f %{buildroot}%{_libexecdir}/snapd/snapd-apparmor +# Remove gpio-chardev ordering target +rm -f %{buildroot}%{_unitdir}/snapd.gpio-chardev-setup.target # Disable re-exec by default -echo 'SNAP_REEXEC=0' > %{buildroot}%{_sysconfdir}/sysconfig/snapd +mkdir -p %{buildroot}%{_sysconfdir}/sysconfig +cat <<'EOF' > %{buildroot}%{_sysconfdir}/sysconfig/snapd +# Snapd daemon can reexec into the binary from the snapd snap, if +# it is newer than the version installed through distro packaging. +# Set to 1 to enable reexec. The default is 0. +#SNAP_REEXEC=0 +EOF # Create state.json and the README file to be ghosted touch %{buildroot}%{_sharedstatedir}/snapd/state.json @@ -769,6 +775,7 @@ make -C data -k check %{_libexecdir}/snapd/snap-failure %{_libexecdir}/snapd/info %{_libexecdir}/snapd/snap-mgmt +%{_libexecdir}/snapd/snapd-apparmor %{_libexecdir}/snapd/snap-mgmt-selinux %{_mandir}/man8/snap.8* %{_datadir}/applications/snap-handle-link.desktop @@ -785,6 +792,7 @@ make -C data -k check %{_unitdir}/snapd.autoimport.service %{_unitdir}/snapd.failure.service %{_unitdir}/snapd.seeded.service +%{_unitdir}/snapd.apparmor.service %{_unitdir}/snapd.mounts.target %{_unitdir}/snapd.mounts-pre.target %{_userunitdir}/snapd.session-agent.service @@ -838,9 +846,8 @@ make -C data -k check %doc cmd/snap-confine/PORTING %license COPYING %dir %{_libexecdir}/snapd -# For now, we can't use caps -# FIXME: Switch to "%%attr(0755,root,root) %%caps(cap_sys_admin=pe)" asap! -%attr(4755,root,root) %{_libexecdir}/snapd/snap-confine +%caps(cap_dac_override,cap_dac_read_search,cap_sys_admin,cap_sys_chroot,cap_chown,cap_fowner,cap_sys_ptrace=p) %{_libexecdir}/snapd/snap-confine +%{_libexecdir}/snapd/snap-confine.caps %{_libexecdir}/snapd/snap-device-helper %{_libexecdir}/snapd/snap-discard-ns %{_libexecdir}/snapd/snap-gdb-shim @@ -940,6 +947,181 @@ if [ $1 -eq 0 ]; then fi %changelog +* Tue Jun 03 2025 Ernest Lotter +- New upstream release 2.70 + - FDE: Fix reseal with v1 hook key format + - FDE: set role in TPM keys + - AppArmor prompting (experimental): add handling for expired + requests or listener in the kernel + - AppArmor prompting: log the notification protocol version + negotiated with the kernel + - AppArmor prompting: implement notification protocol v5 (manually + disabled for now) + - AppArmor prompting: register listener ID with the kernel and + resend notifications after snapd restart (requires protocol v5+) + - AppArmor prompting: select interface from metadata tags and set + request interface accordingly (requires protocol v5+) + - AppArmor prompting: include request PID in prompt + - AppArmor prompting: move the max prompt ID file to a subdirectory + of the snap run directory + - AppArmor prompting: avoid race between closing/reading socket fd + - Confdb (experimental): make save/load hooks mandatory if affecting + ephemeral + - Confdb: clear tx state on failed load + - Confdb: modify 'snap sign' formats JSON in assertion bodies (e.g. + confdb-schema) + - Confdb: add NestedEphemeral to confdb schemas + - Confdb: add early concurrency checks + - Simplify building Arch package + - Enable snapd.apparmor on Fedora + - Build snapd snap with libselinux + - Emit snapd.apparmor warning only when using apparmor backend + - When running snap, on system key mismatch e.g. due to network + attached HOME, trigger and wait for a security profiles + regeneration + - Avoid requiring state lock to get user, warnings, or pending + restarts when handling API requests + - Start/stop ssh.socket for core24+ when enabling/disabling the ssh + service + - Allow providing a different base when overriding snap + - Modify snap-bootstrap to mount snapd snap directly to /snap + - Modify snap-bootstrap to mount /lib/{modules,firmware} from snap + as fallback + - Modify core-initrd to use systemctl reboot instead of /sbin/reboot + - Copy the initramfs 'manifest-initramfs.yaml' to initramfs file + creation directory so it can be copied to the kernel snap + - Build the early initrd from installed ucode packages + - Create drivers tree when remodeling from UC20/22 to UC24 + - Load gpio-aggregator module before the helper-service needs it + - Run 'systemctl start' for mount units to ensure they are run also + when unchanged + - Update godbus version to 'v5 v5.1.0' + - Add support for POST to /v2/system-info with system-key-mismatch + indication from the client + - Add 'snap sign --update-timestamp' flag to update timestamp before + signing + - Add vfs support for snap-update-ns to use to simulate and evaluate + mount sequences + - Add refresh app awareness debug logging + - Add snap-bootstrap scan-disk subcommand to be called from udev + - Add feature to inject proxy store assertions in build image + - Add OP-TEE bindings, enable by default in ARM and ARM64 builds + - Fix systemd dependency options target to go under 'unit' section + - Fix snap-bootstrap reading kernel snap instead of base resulting + in bad modeenv + - Fix a regression during seeding when using early-config + - LP: #2107443 reset SHELL to /bin/bash in non-classic snaps + - Make Azure kernels reboot upon panic + - Fix snap-confine to not drop capabilities if the original user is + already root + - Fix data race when stopping services + - Fix task dependency issue by temporarily disable re-refresh on + prerequisite updates + - Fix compiling against op-tee on armhf + - Fix dbx update when not using FDE + - Fix potential validation set deadlock due to bases waiting on + snaps + - LP: #2104066 Only cancel notices requests on stop/shutdown + - Interfaces: bool-file | fix gpio glob pattern as required for + '[XXXX]*' format + - Interfaces: system-packages-doc | allow access to + /usr/local/share/doc + - Interfaces: ros-snapd-support interface | added new interface + - Interfaces: udisks2 | allow chown capability + - Interfaces: system-observe | allow reading cpu.max + - Interfaces: serial-port | add ttyMAXX to allowed list + - Interfaces: modified seccomp template to disallow + 'O_NOTIFICATION_PIPE' + - Interfaces: fwupd | add support for modem-manager plugin + - Interfaces: gpio-chardev | make unsupported and remove + experimental flag to hide this feature until gpio-aggregator is + available + - Interfaces: hardware-random | fix udev match rule + - Interfaces: timeserver-control | extend to allow timedatectl + timesync commands + - Interfaces: add symlinks backend + - Interfaces: system key mismatch handling + +* Tue Apr 08 2025 Ernest Lotter +- New upstream release 2.69 + - FDE: re-factor listing of the disks based on run mode model and + model to correctly resolve paths + - FDE: run snapd from snap-failure with the correct keyring mode + - Snap components: allow remodeling back to an old snap revision + that includes components + - Snap components: fix remodel to a kernel snap that is already + installed on the system, but not the current kernel due to a + previous remodel. + - Snap components: fix for snapctl inputs that can crash snapd + - Confdb (experimental): load ephemeral data when reading data via + snapctl get + - Confdb (experimental): load ephemeral data when reading data via + snap get + - Confdb (experimental): rename {plug}-view-changed hook to observe- + view-{plug} + - Confdb (experimental): rename confdb assertion to confdb-schema + - Confdb (experimental): change operator grouping in confdb-control + assertion + - Confdb (experimental): add confdb-control API + - AppArmor: extend the probed features to include the presence of + files, as well as directories + - AppArmor prompting (experimental): simplify the listener + - AppArmor metadata tagging (disabled): probe parser support for + tags + - AppArmor metadata tagging (disabled): implement notification + protocol v5 + - Confidential VMs: sysroot.mount is now dynamically created by + snap-bootstrap instead of being a static file in the initramfs + - Confidential VMs: Add new implementation of snap integrity API + - Non-suid snap-confine: first phase to replace snap-confine suid + with capabilities to achieve the required permissions + - Initial changes for dynamic security profiles updates + - Provide snap icon fallback for /v2/icons without requiring network + access at runtime + - Add eMMC gadget update support + - Support reexec when using /usr/libexec/snapd on the host (Arch + Linux, openSUSE) + - Auto detect snap mount dir location on unknown distributions + - Modify snap-confine AppArmor template to allow all glibc HWCAPS + subdirectories to prevent launch errors + - LP: #2102456 update secboot to bf2f40ea35c4 and modify snap- + bootstrap to remove usage of go templates to reduce size by 4MB + - Fix snap-bootstrap to mount kernel snap from + /sysroot/writable/system-data + - LP: #2106121 fix snap-bootstrap busy loop + - Fix encoding of time.Time by using omitzero instead of omitempty + (on go 1.24+) + - Fix setting snapd permissions through permctl for openSUSE + - Fix snap struct json tags typo + - Fix snap pack configure hook permissions check incorrect file mode + - Fix gadget snap reinstall to honor existing sizes of partitions + - Fix to update command line when re-executing a snapd tool + - Fix 'snap validate' of specific missing newline and add error on + missed case of 'snap validate --refresh' without another action + - Workaround for snapd-confine time_t size differences between + architectures + - Disallow pack and install of snapd, base and os with specific + configure hooks + - Drop udev build dependency that is no longer required and add + missing systemd-dev dependency + - Build snap-bootstrap with nomanagers tag to decrease size by 1MB + - Interfaces: polkit | support custom polkit rules + - Interfaces: opengl | LP: #2088456 fix GLX on nvidia when xorg is + confined by AppArmor + - Interfaces: log-observe | add missing udev rule + - Interfaces: hostname-control | fix call to hostnamectl in core24 + - Interfaces: network-control | allow removing created network + namespaces + - Interfaces: scsi-generic | re-enable base declaration for scsi- + generic plug + - Interfaces: u2f | add support for Arculus AuthentiKey + +* Wed Apr 02 2025 Ernest Lotter +- New upstream release 2.68.4 + - Snap components: LP: #2104933 workaround for classic 24.04/24.10 + models that incorrectly specify core22 instead of core24 + - Update build dependencies + * Mon Mar 10 2025 Ernest Lotter - New upstream release 2.68.3 - FDE: LP: #2101834 snapd 2.68+ and snap-bootstrap <2.68 fallback to diff --git a/sources b/sources index 59677d6..cd873e5 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (snapd_2.68.3.no-vendor.tar.xz) = 65039fb0fe515cfcdb2779d5c4b40b64612e9bd7fcc763ac8cd3ddd9efb26d4c7f0b6f58f9c80cec274bed5bfece8c94bad8645189a8a8534b73017e3848a97c -SHA512 (snapd_2.68.3.only-vendor.tar.xz) = b6f68082e4c5df6e957f9da0aec04638821e42629fd13b9660ad3986da9fcde70572c17213d754788408c260814f9369a5d00e212a7f6054918eec4eaa1299f3 +SHA512 (snapd_2.70.no-vendor.tar.xz) = f4864658793d2f6e11823b604c85cadc204a231e7efc5d9302d395c6afc7b500f389317cd3066a39a1d9f138aef5c8a0c2eff07dfb1c5b4473dfa5b489356689 +SHA512 (snapd_2.70.only-vendor.tar.xz) = b6e0309bc56a1573a3edea2e35b3feb313f8220633a64f11f6d0a5b155d39b1b3a2b058edc2d01aca0bf04f4515a17f9011cb49b5c7aa96a5a4610d0032cddcb From 10ef87264cfe02751aa8e21cc05443878a446c63 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 25 Jul 2025 18:28:19 +0000 Subject: [PATCH 28/35] Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild --- snapd.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/snapd.spec b/snapd.spec index e53bd96..5e6f2bc 100644 --- a/snapd.spec +++ b/snapd.spec @@ -84,7 +84,7 @@ Name: snapd Version: 2.70 -Release: 1%{?dist} +Release: 2%{?dist} Summary: A transactional software package manager License: GPL-3.0-only URL: https://%{provider_prefix} @@ -947,6 +947,9 @@ if [ $1 -eq 0 ]; then fi %changelog +* Fri Jul 25 2025 Fedora Release Engineering - 2.70-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + * Tue Jun 03 2025 Ernest Lotter - New upstream release 2.70 - FDE: Fix reseal with v1 hook key format From b45e346b4414ae92f96cb69c9434e0a7e79def9b Mon Sep 17 00:00:00 2001 From: Maxwell G Date: Fri, 15 Aug 2025 18:38:59 -0500 Subject: [PATCH 29/35] Rebuild for golang-1.25.0 --- snapd.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/snapd.spec b/snapd.spec index 5e6f2bc..c34c5fe 100644 --- a/snapd.spec +++ b/snapd.spec @@ -84,7 +84,7 @@ Name: snapd Version: 2.70 -Release: 2%{?dist} +Release: 3%{?dist} Summary: A transactional software package manager License: GPL-3.0-only URL: https://%{provider_prefix} @@ -947,6 +947,9 @@ if [ $1 -eq 0 ]; then fi %changelog +* Fri Aug 15 2025 Maxwell G - 2.70-3 +- Rebuild for golang-1.25.0 + * Fri Jul 25 2025 Fedora Release Engineering - 2.70-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild From 90e21ec4fe69da06a848c2c758179cdf6a586081 Mon Sep 17 00:00:00 2001 From: Zygmunt Krynicki Date: Mon, 1 Sep 2025 08:40:34 +0200 Subject: [PATCH 30/35] Update to snapd 2.71 One more hack was needed to let the package to build in the current form, without proper support for Go modules. I've filed an internal tracking ticket for the next release so that we re-do the package with new Go helpers, remove a lot of generated content that is instead generated at build time, and actually support Go modules for real. https://warthogs.atlassian.net/browse/SNAPDENG-35431 (not visible to the public, apologies, this helps only a limited audience). Signed-off-by: Zygmunt Krynicki --- .gitignore | 4 +- snapd.spec | 270 +++++++++++++++++++++++++++++++++++++++-------------- sources | 4 +- 3 files changed, 204 insertions(+), 74 deletions(-) diff --git a/.gitignore b/.gitignore index 6db0575..05d4ccc 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,2 @@ -/snapd_2.70.no-vendor.tar.xz -/snapd_2.70.only-vendor.tar.xz +/snapd_2.71.no-vendor.tar.xz +/snapd_2.71.only-vendor.tar.xz diff --git a/snapd.spec b/snapd.spec index c34c5fe..d6d327b 100644 --- a/snapd.spec +++ b/snapd.spec @@ -52,7 +52,7 @@ %global provider_prefix %{provider}.%{provider_tld}/%{project}/%{repo} %global import_path %{provider_prefix} -%global snappy_svcs snapd.service snapd.socket snapd.autoimport.service snapd.seeded.service snapd.apparmor.service snapd.mounts.target snapd.mounts-pre.target +%global snappy_svcs snapd.service snapd.socket snapd.seeded.service snapd.apparmor.service snapd.mounts.target snapd.mounts-pre.target %global snappy_user_svcs snapd.session-agent.service snapd.session-agent.socket # Until we have a way to add more extldflags to gobuild macro... @@ -83,8 +83,8 @@ %{!?_tmpfilesdir: %global _tmpfilesdir %{_prefix}/lib/tmpfiles.d} Name: snapd -Version: 2.70 -Release: 3%{?dist} +Version: 2.71 +Release: 0%{?dist} Summary: A transactional software package manager License: GPL-3.0-only URL: https://%{provider_prefix} @@ -159,6 +159,7 @@ BuildRequires: golang(gopkg.in/tomb.v2) BuildRequires: golang(gopkg.in/yaml.v2) BuildRequires: golang(gopkg.in/yaml.v3) %endif +BuildRequires: go-rpm-macros %description Snappy is a modern, cross-distribution, transactional package manager @@ -226,7 +227,6 @@ BuildArch: noarch %endif %if ! 0%{?with_bundled} -Requires: golang(go.etcd.io/bbolt) Requires: golang(github.com/bmatcuk/doublestar/v4) Requires: golang(github.com/coreos/go-systemd/activation) Requires: golang(github.com/godbus/dbus/v5) @@ -236,9 +236,12 @@ Requires: golang(github.com/jessevdk/go-flags) Requires: golang(github.com/juju/ratelimit) Requires: golang(github.com/kr/pretty) Requires: golang(github.com/kr/text) +Requires: golang(github.com/mattn/go-runewidth) Requires: golang(github.com/mvo5/goconfigparser) +Requires: golang(github.com/rivo/uniseg) Requires: golang(github.com/seccomp/libseccomp-golang) Requires: golang(github.com/snapcore/go-gettext) +Requires: golang(go.etcd.io/bbolt) Requires: golang(golang.org/x/crypto/openpgp/armor) Requires: golang(golang.org/x/crypto/openpgp/packet) Requires: golang(golang.org/x/crypto/sha3) @@ -255,8 +258,6 @@ Requires: golang(gopkg.in/yaml.v3) %else # These Provides are unversioned because the sources in # the bundled tarball are unversioned (they go by git commit) -# *sigh*... I hate golang... -Provides: bundled(golang(go.etcd.io/bbolt)) Provides: bundled(golang(github.com/bmatcuk/doublestar/v4)) Provides: bundled(golang(github.com/coreos/go-systemd/activation)) Provides: bundled(golang(github.com/godbus/dbus/v5)) @@ -266,9 +267,12 @@ Provides: bundled(golang(github.com/jessevdk/go-flags)) Provides: bundled(golang(github.com/juju/ratelimit)) Provides: bundled(golang(github.com/kr/pretty)) Provides: bundled(golang(github.com/kr/text)) +Provides: bundled(golang(github.com/mattn/go-runewidth)) Provides: bundled(golang(github.com/mvo5/goconfigparser)) +Provides: bundled(golang(github.com/rivo/uniseg)) Provides: bundled(golang(github.com/seccomp/libseccomp-golang)) Provides: bundled(golang(github.com/snapcore/go-gettext)) +Provides: bundled(golang(go.etcd.io/bbolt)) Provides: bundled(golang(golang.org/x/crypto/openpgp/armor)) Provides: bundled(golang(golang.org/x/crypto/openpgp/packet)) Provides: bundled(golang(golang.org/x/crypto/sha3)) @@ -476,7 +480,7 @@ providing packages with %{import_path} prefix. %if ! 0%{?with_bundled} %setup -q # Ensure there's no bundled stuff accidentally leaking in... -rm -rf vendor/* +rm -rf vendor %else # Extract each tarball properly %setup -q -D -b 1 @@ -500,48 +504,77 @@ export GOPATH=$(pwd):%{gopath} # FIXME: move spec file really to a go.mod world instead of this hack rm -f go.mod export GO111MODULE=off +sed -e 's/-mod=readonly//g' -e 's/-mod=vedor//g' packaging/snapd2.mk # Generate version files ./mkversion.sh "%{version}-%{release}" -# see https://github.com/gofed/go-macros/blob/master/rpm/macros.d/macros.go-compilers-golang -BUILDTAGS= -%if 0%{?with_test_keys} -BUILDTAGS="withtestkeys nosecboot structuredlogging" -%else -BUILDTAGS="nosecboot" -%endif - %if ! 0%{?with_bundled} # We don't need the snapcore fork for bolt - it is just a fix on ppc sed -e "s:github.com/snapcore/bolt:github.com/boltdb/bolt:g" -i advisor/*.go %endif -# We have to build snapd first to prevent the build from -# building various things from the tree without additional -# set tags. -%gobuild -o bin/snapd $GOFLAGS %{import_path}/cmd/snapd -BUILDTAGS="${BUILDTAGS} nomanagers" -%gobuild -o bin/snap $GOFLAGS %{import_path}/cmd/snap -%gobuild -o bin/snap-failure $GOFLAGS %{import_path}/cmd/snap-failure -%gobuild -o bin/snapd-apparmor $GOFLAGS %{import_path}/cmd/snapd-apparmor - -# To ensure things work correctly with base snaps, -# snap-exec, snap-update-ns, and snapctl need to be built statically -( %if 0%{?rhel} >= 7 # since RH Developer tools 2018.4 (and later releases), # the go-toolset module is built with FIPS compliance that # defaults to using libcrypto.so which gets loaded at runtime via dlopen(), # disable that functionality for statically built binaries - BUILDTAGS="${BUILDTAGS} no_openssl" + EXTRA_TAGS="${EXTRA_TAGS} no_openssl" %endif - %gobuild_static -o bin/snap-exec $GOFLAGS %{import_path}/cmd/snap-exec - %gobuild_static -o bin/snap-update-ns $GOFLAGS %{import_path}/cmd/snap-update-ns - %gobuild_static -o bin/snapctl $GOFLAGS %{import_path}/cmd/snapctl -) -%gobuild -o bin/snap-seccomp $GOFLAGS %{import_path}/cmd/snap-seccomp +# Generate snapd.defines.mk, this file is included by snapd.mk. It contains a +# number of variable definitions that are set based on their RPM equivalents. +# Since we can apply any conditional overrides here in the spec file we can +# maintain one consistent set of variables across the spec and makefile worlds. +cat >snapd.defines.mk <<__DEFINES__ +# This file is generated by Fedora's snapd.spec +# Directory variables. +prefix = %{_prefix} +bindir = %{_bindir} +sbindir = %{_sbindir} +libexecdir = %{_libexecdir} +mandir = %{_mandir} +datadir = %{_datadir} +localstatedir = %{_localstatedir} +sharedstatedir = %{_sharedstatedir} +unitdir = %{_unitdir} +builddir = %{_builddir} +# Build configuration +with_core_bits = 0 +with_alt_snap_mount_dir = 1 +with_apparmor = 1 +with_testkeys = %{with_test_keys} +with_vendor = %{with_bundled} +# follow what %%gobuild does +EXTRA_GO_BUILD_FLAGS = -v -x -compiler gc +EXTRA_GO_LDFLAGS = -linkmode external -extldflags '%__global_ldflags' +EXTRA_GO_STATIC_LDFLAGS = -linkmode external -extldflags '%__global_ldflags -static' +EXTRA_GO_BUILD_TAGS = rpm_crashtraceback $EXTRA_TAGS +__DEFINES__ + +# Generate version files + +cat <snapdtool/version_generated.go +package snapdtool + +// generated by snapd.spec; do not edit + +func init() { + Version = "%{version}-%{release}" +} +EOF + +cat <cmd/VERSION +%{version}-%{release} +EOF + +# FIXME: We paste a fixed string but we should run some go code to generate the +# real value. We don't want to do that as that code needs to use host's +# libraries without talking to the proxy. +cat <data/info +SNAPD_APPARMOR_REEXEC=0 +SNAPD_ASSERTS_FORMATS='{"account-key":1,"snap-declaration":6,"system-user":2}' +EOF ( %if 0%{?rhel} == 7 @@ -577,6 +610,11 @@ autoreconf --force --install --verbose %make_build %{!?with_valgrind:HAVE_VALGRIND=} popd +# Build snap, snapd and other tools +%make_build -f packaging/snapd2.mk \ + SNAPD_DEFINES_DIR=$PWD \ + all + # Build systemd units, dbus services, and env files pushd ./data make BINDIR="%{_bindir}" LIBEXECDIR="%{_libexecdir}" DATADIR="%{_datadir}" \ @@ -621,25 +659,10 @@ install -d -p %{buildroot}%{_datadir}/polkit-1/actions install -d -p %{buildroot}%{_datadir}/selinux/devel/include/contrib install -d -p %{buildroot}%{_datadir}/selinux/packages -# Install snap and snapd -install -p -m 0755 bin/snap %{buildroot}%{_bindir} -install -p -m 0755 bin/snap-exec %{buildroot}%{_libexecdir}/snapd -install -p -m 0755 bin/snap-failure %{buildroot}%{_libexecdir}/snapd -install -p -m 0755 bin/snapd %{buildroot}%{_libexecdir}/snapd -install -p -m 0755 bin/snap-update-ns %{buildroot}%{_libexecdir}/snapd -install -p -m 0755 bin/snap-seccomp %{buildroot}%{_libexecdir}/snapd -install -p -m 0755 bin/snapd-apparmor %{buildroot}%{_libexecdir}/snapd -# Ensure /usr/bin/snapctl is a symlink to /usr/libexec/snapd/snapctl -install -p -m 0755 bin/snapctl %{buildroot}%{_libexecdir}/snapd/snapctl -ln -sf %{_libexecdir}/snapd/snapctl %{buildroot}%{_bindir}/snapctl - # Install SELinux module install -p -m 0644 data/selinux/snappy.if %{buildroot}%{_datadir}/selinux/devel/include/contrib install -p -m 0644 data/selinux/snappy.pp.bz2 %{buildroot}%{_datadir}/selinux/packages -# Install snap(8) man page -bin/snap help --man > %{buildroot}%{_mandir}/man8/snap.8 - # Install the "info" data file with snapd version install -m 644 -D data/info %{buildroot}%{_libexecdir}/snapd/info @@ -669,6 +692,12 @@ pushd ./data SNAPD_ENVIRONMENT_FILE="%{_sysconfdir}/sysconfig/snapd" popd +# Install snap, snapd and tools +# auto-remove unnecessary files and service units +%make_install -f packaging/snapd2.mk \ + SNAPD_DEFINES_DIR=$PWD \ + install + %if 0%{?rhel} == 7 # Install kernel tweaks # See: https://access.redhat.com/articles/3128691 @@ -676,14 +705,7 @@ install -m 644 -D data/sysctl/rhel7-snap.conf %{buildroot}%{_sysctldir}/99-snap. %endif # Remove snappy core specific units -rm -fv %{buildroot}%{_unitdir}/snapd.system-shutdown.service -rm -fv %{buildroot}%{_unitdir}/snapd.snap-repair.* -rm -fv %{buildroot}%{_unitdir}/snapd.core-fixup.* -rm -fv %{buildroot}%{_unitdir}/snapd.recovery-chooser-trigger.service - -# Remove snappy core specific scripts and binaries -rm %{buildroot}%{_libexecdir}/snapd/snapd.core-fixup.sh -rm %{buildroot}%{_libexecdir}/snapd/system-shutdown +rm -fv %{buildroot}%{_unitdir}/snapd.failure.service # Remove gpio-chardev ordering target rm -f %{buildroot}%{_unitdir}/snapd.gpio-chardev-setup.target @@ -737,19 +759,14 @@ sort -u -o devel.file-list devel.file-list %check for binary in snap-exec snap-update-ns snapctl; do - ldd bin/$binary 2>&1 | grep 'not a dynamic executable' + ldd %{_builddir}/$binary 2>&1 | grep 'not a dynamic executable' done # snapd tests %if 0%{?with_check} && 0%{?with_unit_test} && 0%{?with_devel} -%if ! 0%{?with_bundled} -export GOPATH=%{buildroot}/%{gopath}:%{gopath} -%else -export GOPATH=%{buildroot}/%{gopath}:$(pwd)/Godeps/_workspace:%{gopath} -%endif -# FIXME: we are in the go.mod world now but without this things fall apart -export GO111MODULE=off -%gotest %{import_path}/... +%make_build -f packaging/snapd2.mk \ + SNAPD_DEFINES_DIR=$PWD \ + check %endif # snap-confine tests (these always run!) @@ -772,7 +789,6 @@ make -C data -k check %{_libexecdir}/snapd/snapctl %{_libexecdir}/snapd/snapd %{_libexecdir}/snapd/snap-exec -%{_libexecdir}/snapd/snap-failure %{_libexecdir}/snapd/info %{_libexecdir}/snapd/snap-mgmt %{_libexecdir}/snapd/snapd-apparmor @@ -789,8 +805,6 @@ make -C data -k check %{_systemd_system_env_generator_dir}/snapd-env-generator %{_unitdir}/snapd.socket %{_unitdir}/snapd.service -%{_unitdir}/snapd.autoimport.service -%{_unitdir}/snapd.failure.service %{_unitdir}/snapd.seeded.service %{_unitdir}/snapd.apparmor.service %{_unitdir}/snapd.mounts.target @@ -829,13 +843,19 @@ make -C data -k check %dir %{_sharedstatedir}/snapd/mount %dir %{_sharedstatedir}/snapd/seccomp %dir %{_sharedstatedir}/snapd/seccomp/bpf +%ghost %{_sharedstatedir}/snapd/seccomp/bpf/global.bin %dir %{_sharedstatedir}/snapd/snaps %dir %{_sharedstatedir}/snapd/snap %ghost %dir %{_sharedstatedir}/snapd/snap/bin -%dir %{_localstatedir}/cache/snapd -%dir %{_localstatedir}/snap %ghost %{_sharedstatedir}/snapd/state.json +%ghost %{_sharedstatedir}/snapd/system-key +%ghost %{_sharedstatedir}/snapd/snap/bin %ghost %{_sharedstatedir}/snapd/snap/README +%dir %{_localstatedir}/cache/snapd +%ghost %{_localstatedir}/cache/snapd/commands +%ghost %{_localstatedir}/cache/snapd/names +%ghost %{_localstatedir}/cache/snapd/sections +%dir %{_localstatedir}/snap # this is typically owned by zsh, but we do not want to explicitly require zsh %dir %{_datadir}/zsh %dir %{_datadir}/zsh/site-functions @@ -947,6 +967,116 @@ if [ $1 -eq 0 ]; then fi %changelog +* Fri Aug 22 2025 Ernest Lotter +- New upstream release 2.71 + - FDE: auto-repair when recovery key is used + - FDE: revoke keys on shim update + - FDE: revoke old TPM keys when dbx has been updated + - FDE: do not reseal FDE hook keys every time + - FDE: store keys in the kernel keyring when installing from initrd + - FDE: allow disabled DMA on Core + - FDE: snap-bootstrap: do not check for partition in scan-disk on + CVM + - FDE: support secboot preinstall check for 25.10+ hybrid installs + via the /v2/system/{label} endpoint + - FDE: support generating recovery key at install time via the + /v2/systems/{label} endpoint + - FDE: update passphrase quality check at install time via the + /v2/systems/{label} endpoint + - FDE: support replacing recovery key at runtime via the new + /v2/system-volumes endpoint + - FDE: support checking recovery keys at runtime via the /v2/system- + volumes endpoint + - FDE: support enumerating keyslots at runtime via the /v2/system- + volumes endpoint + - FDE: support changing passphrase at runtime via the /v2/system- + volumes endpoint + - FDE: support passphrase quality check at runtime via the + /v2/system-volumes endpoint + - FDE: update secboot to revision 3e181c8edf0f + - Confdb: support lists and indexed paths on read and write + - Confdb: alias references must be wrapped in brackets + - Confdb: support indexed paths in confdb-schema assertion + - Confdb: make API errors consistent with options + - Confdb: fetch confdb-schema assertion on access + - Confdb: prevent --previous from being used in read-side hooks + - Components: fix snap command with multiple components + - Components: set revision of seed components to x1 + - Components: unmount extra kernel-modules components mounts + - AppArmor Prompting: add lifespan "session" for prompting rules + - AppArmor Prompting: support restoring prompts after snapd restart + - AppArmor Prompting: limit the extra information included in probed + AppArmor features and system key + - Notices: refactor notice state internals + - SELinux: look for restorecon/matchpathcon at all known locations + rather than current PATH + - SELinux: update policy to allow watching cgroups (for RAA), and + talking to user session agents (service mgmt/refresh) + - Refresh App Awareness: Fix unexpected inotify file descriptor + cleanup + - snap-confine: workaround for glibc fchmodat() fallback and handle + ENOSYS + - snap-confine: add support for host policy for limiting users able + to run snaps + - LP: #2114923 Reject system key mismatch advise when not yet seeded + - Use separate lanes for essential and non-essential snaps during + seeding and allow non-essential installs to retry + - Fix bug preventing remodel from core18 to core18 when snapd snap + is unchanged + - LP: #2112551 Make removal of last active revision of a snap equal + to snap remove + - LP: #2114779 Allow non-gpt in fallback mode to support RPi + - Switch from using systemd LogNamespace to manually controlled + journal quotas + - Change snap command trace logging to only log the command names + - Grant desktop-launch access to /v2/snaps + - Update code for creating the snap journal stream + - Switch from using core to snapd snap for snap debug connectivity + - LP: #2112544 Fix offline remodel case where we switched to a + channel without an actual refresh + - LP: #2112332 Exclude snap/snapd/preseeding when generating preseed + tarball + - LP: #1952500 Fix snap command progress reporting + - LP: #1849346 Interfaces: kerberos-tickets | add new interface + - Interfaces: u2f | add support for Thetis Pro + - Interfaces: u2f | add OneSpan device and fix older device + - Interfaces: pipewire, audio-playback | support pipewire as system + daemon + - Interfaces: gpg-keys | allow access to GPG agent sockets + - Interfaces: usb-gadget | add new interface + - Interfaces: snap-fde-control, firmware-updater-support | add new + interfaces to support FDE + - Interfaces: timezone-control | extend to support timedatectl + varlink + - Interfaces: cpu-control | fix rules for accessing IRQ sysfs and + procfs directories + - Interfaces: microstack-support | allow SR-IOV attachments + - Interfaces: modify AppArmor template to allow snaps to read their + own systemd credentials + - Interfaces: posix-mq | allow stat on /dev/mqueue + - LP: #2098780 Interfaces: log-observe | add capability + dac_read_search + - Interfaces: block-devices | allow access to ZFS pools and datasets + - LP: #2033883 Interfaces: block-devices | opt-in access to + individual partitions + - Interfaces: accel | add new interface to support accel kernel + subsystem + - Interfaces: shutdown | allow client to bind on its side of dbus + socket + - Interfaces: modify seccomp template to allow pwritev2 + - Interfaces: modify AppArmor template to allow reading + /proc/sys/fs/nr_open + - Packaging: drop snap.failure service for openSUSE + - Packaging: add SELinux support for openSUSE + - Packaging: disable optee when using nooptee build tag + - Packaging: add support for static PIE builds in snapd.mk, drop + pie.patch from openSUSE + - Packaging: add libcap2-bin runtime dependency for ubuntu-16.04 + - Packaging: use snapd.mk for packaging on Fedora + - Packaging: exclude .git directory + - Packaging: fix DPKG_PARSECHANGELOG assignment + - Packaging: fix building on Fedora with dpkg installed + * Fri Aug 15 2025 Maxwell G - 2.70-3 - Rebuild for golang-1.25.0 diff --git a/sources b/sources index cd873e5..b2f48cb 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (snapd_2.70.no-vendor.tar.xz) = f4864658793d2f6e11823b604c85cadc204a231e7efc5d9302d395c6afc7b500f389317cd3066a39a1d9f138aef5c8a0c2eff07dfb1c5b4473dfa5b489356689 -SHA512 (snapd_2.70.only-vendor.tar.xz) = b6e0309bc56a1573a3edea2e35b3feb313f8220633a64f11f6d0a5b155d39b1b3a2b058edc2d01aca0bf04f4515a17f9011cb49b5c7aa96a5a4610d0032cddcb +SHA512 (snapd_2.71.no-vendor.tar.xz) = 3cb250aff6ecf75236736e844da2cbb2a0275993a5da8f4dda3b25141719aea5d9db429191dada1c627b46687513d288f0a52c73d46004f8675bb2a38f1369a2 +SHA512 (snapd_2.71.only-vendor.tar.xz) = 413f73d163e6b15550c012f97e77cd754a1c631f290ddcc64526fd34ccf5e5e8f12242ccd3af56bf18633b7f635aa093f9f9645d3959d208708048c1f43d0b9b From 9f2b3ebfd0e212b1b4228acd6f0bf9238b4f0b79 Mon Sep 17 00:00:00 2001 From: Zygmunt Krynicki Date: Mon, 1 Sep 2025 14:51:00 +0200 Subject: [PATCH 31/35] Remove c-vendor directory When we remove the vendor directory, remove the C quivalent as well. Signed-off-by: Zygmunt Krynicki --- snapd.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/snapd.spec b/snapd.spec index d6d327b..f021579 100644 --- a/snapd.spec +++ b/snapd.spec @@ -480,7 +480,7 @@ providing packages with %{import_path} prefix. %if ! 0%{?with_bundled} %setup -q # Ensure there's no bundled stuff accidentally leaking in... -rm -rf vendor +rm -rf vendor c-vendor %else # Extract each tarball properly %setup -q -D -b 1 From 219b5fd9465aa409b4cd3824c7e432d98ed7d205 Mon Sep 17 00:00:00 2001 From: Zygmunt Krynicki Date: Mon, 1 Sep 2025 14:52:53 +0200 Subject: [PATCH 32/35] Fix typo: vendor Signed-off-by: Zygmunt Krynicki --- snapd.spec | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/snapd.spec b/snapd.spec index f021579..6a96704 100644 --- a/snapd.spec +++ b/snapd.spec @@ -504,7 +504,9 @@ export GOPATH=$(pwd):%{gopath} # FIXME: move spec file really to a go.mod world instead of this hack rm -f go.mod export GO111MODULE=off -sed -e 's/-mod=readonly//g' -e 's/-mod=vedor//g' packaging/snapd2.mk +# Ensure we do not pass -mod=foo argument to go, as we disable modules and go +# does not allow us to do both. +sed -e 's/-mod=readonly//g' -e 's/-mod=vendor//g' packaging/snapd2.mk # Generate version files ./mkversion.sh "%{version}-%{release}" From f5a846262ad9bbabcabad46c08ee1f18d0e63343 Mon Sep 17 00:00:00 2001 From: Zygmunt Krynicki Date: Mon, 1 Sep 2025 14:53:43 +0200 Subject: [PATCH 33/35] Do not call mkversion.sh Instead, generate the required data by hand. This avoids the need to "go run" during the build process. Signed-off-by: Zygmunt Krynicki --- snapd.spec | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) diff --git a/snapd.spec b/snapd.spec index 6a96704..10d58d6 100644 --- a/snapd.spec +++ b/snapd.spec @@ -509,7 +509,23 @@ export GO111MODULE=off sed -e 's/-mod=readonly//g' -e 's/-mod=vendor//g' packaging/snapd2.mk # Generate version files -./mkversion.sh "%{version}-%{release}" +cat <snapdtool/version_generated.go +package snapdtool + +func init() { + Version = "%{version}-%{release}" +} +EOF + +cat <cmd/VERSION +%{version}-%{release} +EOF + +cat <data/info +VERSION=%{version}-%{release} +SNAPD_APPARMOR_REEXEC=0 +SNAPD_ASSERTS_FORMATS='{"account-key":1,"snap-declaration":6,"system-user":2}' +EOF %if ! 0%{?with_bundled} # We don't need the snapcore fork for bolt - it is just a fix on ppc From b039f9bddeb72587da66a00685781586e7041ee4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Alejandro=20S=C3=A1ez?= Date: Fri, 10 Oct 2025 15:11:25 +0200 Subject: [PATCH 34/35] rebuild --- snapd.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/snapd.spec b/snapd.spec index 10d58d6..a548072 100644 --- a/snapd.spec +++ b/snapd.spec @@ -84,7 +84,7 @@ Name: snapd Version: 2.71 -Release: 0%{?dist} +Release: 1%{?dist} Summary: A transactional software package manager License: GPL-3.0-only URL: https://%{provider_prefix} @@ -985,6 +985,9 @@ if [ $1 -eq 0 ]; then fi %changelog +* Fri Oct 10 2025 Alejandro Sáez - 2.71-1 +- rebuild + * Fri Aug 22 2025 Ernest Lotter - New upstream release 2.71 - FDE: auto-repair when recovery key is used From c0b6ac858c8dacec9f460ac3726b30768d2be7e0 Mon Sep 17 00:00:00 2001 From: Zygmunt Krynicki Date: Thu, 13 Nov 2025 14:50:24 +0100 Subject: [PATCH 35/35] Update to snapd 2.72 Signed-off-by: Zygmunt Krynicki --- .gitignore | 2 + snapd.spec | 118 ++++++++++++++++++++++++++++++++++++++++++++++++++++- sources | 4 +- 3 files changed, 120 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 05d4ccc..981b550 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,4 @@ /snapd_2.71.no-vendor.tar.xz /snapd_2.71.only-vendor.tar.xz +/snapd_2.72.no-vendor.tar.xz +/snapd_2.72.only-vendor.tar.xz diff --git a/snapd.spec b/snapd.spec index a548072..073ba90 100644 --- a/snapd.spec +++ b/snapd.spec @@ -55,6 +55,11 @@ %global snappy_svcs snapd.service snapd.socket snapd.seeded.service snapd.apparmor.service snapd.mounts.target snapd.mounts-pre.target %global snappy_user_svcs snapd.session-agent.service snapd.session-agent.socket +# Note that packaging for Fedora does omit cap_setgid and cap_setuid that are +# only required to use snapd in user namespaces when the host system uses +# cgroup-v1 hierarchy. Since no actively supported Fedora release uses cgroup +# v1, those capabilities are omitted. +%global snap_confine_caps cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_sys_chroot,cap_sys_ptrace,cap_sys_admin=p # Until we have a way to add more extldflags to gobuild macro... # Always use external linking when building static binaries. %if 0%{?fedora} || 0%{?rhel} >= 8 @@ -83,7 +88,7 @@ %{!?_tmpfilesdir: %global _tmpfilesdir %{_prefix}/lib/tmpfiles.d} Name: snapd -Version: 2.71 +Version: 2.72 Release: 1%{?dist} Summary: A transactional software package manager License: GPL-3.0-only @@ -884,8 +889,9 @@ make -C data -k check %doc cmd/snap-confine/PORTING %license COPYING %dir %{_libexecdir}/snapd -%caps(cap_dac_override,cap_dac_read_search,cap_sys_admin,cap_sys_chroot,cap_chown,cap_fowner,cap_sys_ptrace=p) %{_libexecdir}/snapd/snap-confine +%caps(%{snap_confine_caps}) %{_libexecdir}/snapd/snap-confine %{_libexecdir}/snapd/snap-confine.caps +%{_libexecdir}/snapd/snap-confine.v2-only.caps %{_libexecdir}/snapd/snap-device-helper %{_libexecdir}/snapd/snap-discard-ns %{_libexecdir}/snapd/snap-gdb-shim @@ -985,6 +991,114 @@ if [ $1 -eq 0 ]; then fi %changelog +* Thu Nov 13 2025 Ernest Lotter +- New upstream release 2.72 + - FDE: support replacing TPM protected keys at runtime via the + /v2/system-volumes endpoint + - FDE: support secboot preinstall check fix actions for 25.10+ + hybrid installs via the /v2/system/{label} endpoint + - FDE: tweak polkit message to remove jargon + - FDE: ensure proper sealing with kernel command line defaults + - FDE: provide generic reseal function + - FDE: support using OPTEE for protecting keys, as an alternative to + existing fde-setup hooks (Ubuntu Core only) + - Confdb: 'snapctl get --view' supports passing default values + - Confdb: content sub-rules in confdb-schemas inherit their parent + rule's "access" + - Confdb: make confdb error kinds used in API more generic + - Confdb: fully support lists and indexed paths (including unset) + - Prompting: add notice backend for prompting types (unused for now) + - Prompting: include request cgroup in prompt + - Prompting: handle unsupported xattrs + - Prompting: add permission mapping for the camera interface + - Notices: read notices from state without state lock + - Notices: add methods to get notice fields and create, reoccur, and + deepcopy notice + - Notices: add notice manager to coordinate separate notice backends + - Notices: support draining notices from state when notice backend + registered as producer of a particular notice type + - Notices: query notice manager from daemon instead of querying + state for notices directly + - Packaging: Ubuntu | ignore .git directory + - Packaging: FIPS | bump deb Go FIPS to 1.23 + - Packaging: snap | bump FIPS toolchain to 1.23 + - Packaging: debian | sync most upstream changes + - Packaging: debian-sid | depends on libcap2-bin for postint + - Packaging: Fedora | drop fakeroot + - Packaging: snap | modify snapd.mk to pass build tags when running + unit tests + - Packaging: snap | modify snapd.mk to pass nooptee build tag + - Packaging: modify Makefile.am to fix snap-confine install profile + with 'make hack' + - Packaging: modify Makefile.am to fix out-of-tree use of 'make + hack' + - LP: #2122054 Snap installation: skip snap icon download when + running in a cloud or using a proxy store + - Snap installation: add timeout to http client when downloading + snap icon + - Snap installation: use http(s) proxy for icon downloads + - LP: #2117558 snap-confine: fix error message with /root/snap not + accessible + - snap-confine: fix non-suid limitation by switching to root:root to + operate v1 freezer + - core-initrd: do not use writable-paths when not available + - core-initrd: remove debian folder + - LP: #1916244 Interfaces: gpio-chardev | re-enable the gpio-chardev + interface now with the more robust gpio-aggregator configfs kernel + interface + - Interfaces: gpio-chardev | exclusive snap connections, raise a + conflict when both gpio-chardev and gpio are connected + - Interfaces: gpio-chardev | fix gpio-aggregator module load order + - Interfaces: ros-snapd-support | grant access to /v2/changes + - Interfaces: uda-driver-libs, egl-driver-libs, gbm-driver-libs, + opengl-driver-libs, opengles-driver-libs | new interfaces to + support nvidia driver components + - Interfaces: microstack-support | allow DPDK (hugepage related + permissions) + - Interfaces: system-observe | allow reading additional files in + /proc, needed by node-exporter + - Interfaces: u2f | add Cano Key, Thesis FIDO2 BioFP+ Security Key + and Kensington VeriMark DT Fingerprint Key to device list + - Interfaces: snap-interfaces-requests-control | allow shell API + control + - Interfaces: fwupd | allow access to Intel CVS sysfs + - Interfaces: hardware-observe | allow read access to Kernel + Samepage Merging (KSM) + - Interfaces: xilinx-dma | support Multi Queue DMA (QDMA) IP + - Interfaces: spi | relax sysfs permission rules to allow access to + SPI device node attributes + - Interfaces: content | introduce compatibility label + - LP: #2121238 Interfaces: do not expose Kerberos tickets for + classic snaps + - Interfaces: ssh-public-keys | allow ro access to public host keys + with ssh-key + - Interfaces: Modify AppArmor template to allow listing systemd + credentials and invoking systemd-creds + - Interfaces: modify AppArmor template with workarounds for Go 1.35 + cgroup aware GOMAXPROCS + - Interfaces: modify seccomp template to allow landlock_* + - Prevent snap hooks from running while relevant snaps are unlinked + - Make refreshes wait before unlinking snaps if running hooks can be + affected + - Fix systemd unit generation by moving "WantedBy=" from section + "unit" to "install" + - Add opt-in logging support for snap-update-ns + - Unhide 'snap help' sign and export-key under Development category + - LP: #2117121 Cleanly support socket activation for classic snap + - Add architecture to 'snap version' output + - Add 'snap debug api' option to disable authentication through + auth.json + - Show grade in notes for 'snap info --verbose' + - Fix preseeding failure due to scan-disk issue on RPi + - Support 'snap debug api' queries to user session agents + - LP: #2112626 Improve progress reporting for snap install/refresh + - Drop legacy BAMF_DESKTOP_FILE_HINT in desktop files + - Fix /v2/apps error for root user when user services are present + - LP: #2114704 Extend output to indicate when snap data snapshot was + created during remove + - Improve how we handle emmc volumes + - Improve handling of system-user extra assertions + * Fri Oct 10 2025 Alejandro Sáez - 2.71-1 - rebuild diff --git a/sources b/sources index b2f48cb..5ba5479 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (snapd_2.71.no-vendor.tar.xz) = 3cb250aff6ecf75236736e844da2cbb2a0275993a5da8f4dda3b25141719aea5d9db429191dada1c627b46687513d288f0a52c73d46004f8675bb2a38f1369a2 -SHA512 (snapd_2.71.only-vendor.tar.xz) = 413f73d163e6b15550c012f97e77cd754a1c631f290ddcc64526fd34ccf5e5e8f12242ccd3af56bf18633b7f635aa093f9f9645d3959d208708048c1f43d0b9b +SHA512 (snapd_2.72.no-vendor.tar.xz) = fb556bdb60877a2536cd8e53a7e137935ba27afb5b04efff06d8f858c47cec82a8f1df01fb621f644f0c2abe056a2b0612fabd70ae2d909b2e960692763b8bff +SHA512 (snapd_2.72.only-vendor.tar.xz) = f80b5def82553c044027fbb208fc5d5f76633afe71a8210abc33b48b189fd9347fd1d04bc868c58dc5d0b7fe8c68f6e316edbb6d2a2e060f375a5cdc851c2278