diff --git a/.gitignore b/.gitignore index 981b550..ccd44c6 100644 --- a/.gitignore +++ b/.gitignore @@ -1,4 +1,100 @@ -/snapd_2.71.no-vendor.tar.xz -/snapd_2.71.only-vendor.tar.xz -/snapd_2.72.no-vendor.tar.xz -/snapd_2.72.only-vendor.tar.xz +/snapcore-selinux-6331fd4.tar.gz +/snapd-2.16.tar.gz +/snapcore-selinux-e5c1177.tar.gz +/snapcore-selinux-4566045.tar.gz +/snapd-2.23.6.tar.gz +/snapd-2.24.tar.gz +/snapd-2.25.tar.gz +/snapd-2.26.3.tar.gz +/snapd-2.27.tar.gz +/snapd-2.27.1.tar.gz +/snapd-2.27.2.tar.gz +/snapd-2.27.5.tar.gz +/snapd-2.27.6.tar.gz +/snapd-2.28.1.tar.gz +/snapd-2.28.4.tar.gz +/snapd-2.28.5.tar.gz +/snapd-2.29.4.tar.gz +/snapd-2.30.tar.gz +/snapd-2.31.1.tar.gz +/snapd-2.32.4.tar.gz +/snapd-2.33.1.tar.gz +/snapd-2.35.tar.gz +/snapd-2.36.tar.gz +/snapd_2.36.only-vendor.tar.xz +/snapd-2.36.3.tar.gz +/snapd_2.36.3.only-vendor.tar.xz +/snapd-2.37.2.tar.gz +/snapd_2.37.2.only-vendor.tar.xz +/snapd-2.37.3.tar.gz +/snapd_2.37.3.only-vendor.tar.xz +/snapd-2.37.4.tar.gz +/snapd_2.37.4.only-vendor.tar.xz +/snapd_2.38.no-vendor.tar.xz +/snapd_2.38.only-vendor.tar.xz +/snapd_2.39.no-vendor.tar.xz +/snapd_2.39.only-vendor.tar.xz +/snapd_2.39.1.no-vendor.tar.xz +/snapd_2.39.1.only-vendor.tar.xz +/snapd_2.39.2.no-vendor.tar.xz +/snapd_2.39.2.only-vendor.tar.xz +/snapd_2.41.no-vendor.tar.xz +/snapd_2.41.only-vendor.tar.xz +/snapd_2.42.no-vendor.tar.xz +/snapd_2.42.only-vendor.tar.xz +/snapd_2.42.1.no-vendor.tar.xz +/snapd_2.42.1.only-vendor.tar.xz +/snapd_2.42.2.no-vendor.tar.xz +/snapd_2.42.2.only-vendor.tar.xz +/snapd_2.43.3.no-vendor.tar.xz +/snapd_2.43.3.only-vendor.tar.xz +/snapd_2.45.no-vendor.tar.xz +/snapd_2.45.only-vendor.tar.xz +/snapd_2.45.1.no-vendor.tar.xz +/snapd_2.45.1.only-vendor.tar.xz +/snapd_2.45.2.no-vendor.tar.xz +/snapd_2.45.2.only-vendor.tar.xz +/snapd_2.45.3.1.no-vendor.tar.xz +/snapd_2.45.3.1.only-vendor.tar.xz +/snapd_2.46.1.no-vendor.tar.xz +/snapd_2.46.1.only-vendor.tar.xz +/snapd_2.47.1.no-vendor.tar.xz +/snapd_2.47.1.only-vendor.tar.xz +/snapd_2.48.2.no-vendor.tar.xz +/snapd_2.48.2.only-vendor.tar.xz +/snapd_2.49.no-vendor.tar.xz +/snapd_2.49.only-vendor.tar.xz +/snapd_2.50.no-vendor.tar.xz +/snapd_2.50.only-vendor.tar.xz +/snapd_2.51.no-vendor.tar.xz +/snapd_2.51.only-vendor.tar.xz +/snapd_2.51.7.no-vendor.tar.xz +/snapd_2.51.7.only-vendor.tar.xz +/snapd_2.52.no-vendor.tar.xz +/snapd_2.52.only-vendor.tar.xz +/snapd_2.53.1.no-vendor.tar.xz +/snapd_2.53.1.only-vendor.tar.xz +/snapd_2.53.2.no-vendor.tar.xz +/snapd_2.53.2.only-vendor.tar.xz +/snapd_2.53.4.no-vendor.tar.xz +/snapd_2.53.4.only-vendor.tar.xz +/snapd_2.54.1.no-vendor.tar.xz +/snapd_2.54.1.only-vendor.tar.xz +/snapd_2.54.2.no-vendor.tar.xz +/snapd_2.54.2.only-vendor.tar.xz +/snapd_2.54.3.no-vendor.tar.xz +/snapd_2.54.3.only-vendor.tar.xz +/snapd_2.54.4.no-vendor.tar.xz +/snapd_2.54.4.only-vendor.tar.xz +/snapd_2.55.2.no-vendor.tar.xz +/snapd_2.55.2.only-vendor.tar.xz +/snapd_2.55.3.no-vendor.tar.xz +/snapd_2.55.3.only-vendor.tar.xz +/snapd_2.56.2.no-vendor.tar.xz +/snapd_2.56.2.only-vendor.tar.xz +/snapd_2.57.5.no-vendor.tar.xz +/snapd_2.57.5.only-vendor.tar.xz +/snapd_2.57.6.no-vendor.tar.xz +/snapd_2.57.6.only-vendor.tar.xz +/snapd_2.58.3.no-vendor.tar.xz +/snapd_2.58.3.only-vendor.tar.xz diff --git a/snapd.spec b/snapd.spec index 073ba90..70b3652 100644 --- a/snapd.spec +++ b/snapd.spec @@ -52,32 +52,27 @@ %global provider_prefix %{provider}.%{provider_tld}/%{project}/%{repo} %global import_path %{provider_prefix} -%global snappy_svcs snapd.service snapd.socket snapd.seeded.service snapd.apparmor.service snapd.mounts.target snapd.mounts-pre.target +%global snappy_svcs snapd.service snapd.socket snapd.autoimport.service snapd.seeded.service snapd.mounts.target snapd.mounts-pre.target %global snappy_user_svcs snapd.session-agent.service snapd.session-agent.socket -# Note that packaging for Fedora does omit cap_setgid and cap_setuid that are -# only required to use snapd in user namespaces when the host system uses -# cgroup-v1 hierarchy. Since no actively supported Fedora release uses cgroup -# v1, those capabilities are omitted. -%global snap_confine_caps cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_sys_chroot,cap_sys_ptrace,cap_sys_admin=p # Until we have a way to add more extldflags to gobuild macro... # Always use external linking when building static binaries. %if 0%{?fedora} || 0%{?rhel} >= 8 -%define gobuild_static(o:) go build -buildmode pie -compiler gc -tags="rpm_crashtraceback ${BUILDTAGS:-}" -ldflags "-B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \\n') -linkmode external -extldflags '%__global_ldflags -static'" -a -v %{?**}; +%define gobuild_static(o:) go build -buildmode pie -compiler gc -tags="rpm_crashtraceback ${BUILDTAGS:-}" -ldflags "-B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \\n') -linkmode external -extldflags '%__global_ldflags -static'" -a -v -x %{?**}; %endif %if 0%{?rhel} == 7 # no pass PIE flags due to https://bugzilla.redhat.com/show_bug.cgi?id=1634486 -%define gobuild_static(o:) go build -compiler gc -tags="rpm_crashtraceback ${BUILDTAGS:-}" -ldflags "-B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \\n') -linkmode external -extldflags '%__global_ldflags -static'" -a -v %{?**}; +%define gobuild_static(o:) go build -compiler gc -tags="rpm_crashtraceback ${BUILDTAGS:-}" -ldflags "-B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \\n') -linkmode external -extldflags '%__global_ldflags -static'" -a -v -x %{?**}; %endif # These macros are missing BUILDTAGS in RHEL 8/9, see RHBZ#1825138 %if 0%{?rhel} >= 8 -%define gobuild(o:) go build -buildmode pie -compiler gc -tags="rpm_crashtraceback ${BUILDTAGS:-}" -ldflags "-B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \\n') -linkmode external -extldflags '%__global_ldflags'" -a -v %{?**}; +%define gobuild(o:) go build -buildmode pie -compiler gc -tags="rpm_crashtraceback ${BUILDTAGS:-}" -ldflags "-B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \\n') -linkmode external -extldflags '%__global_ldflags'" -a -v -x %{?**}; %endif # These macros are not defined in RHEL 7 %if 0%{?rhel} == 7 -%define gobuild(o:) go build -compiler gc -tags="rpm_crashtraceback ${BUILDTAGS:-}" -ldflags "-B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \\n') -linkmode external -extldflags '%__global_ldflags'" -a -v %{?**}; +%define gobuild(o:) go build -compiler gc -tags="rpm_crashtraceback ${BUILDTAGS:-}" -ldflags "-B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \\n') -linkmode external -extldflags '%__global_ldflags'" -a -v -x %{?**}; %define gotest() go test -compiler gc %{?**}; %endif @@ -88,10 +83,10 @@ %{!?_tmpfilesdir: %global _tmpfilesdir %{_prefix}/lib/tmpfiles.d} Name: snapd -Version: 2.72 +Version: 2.58.3 Release: 1%{?dist} Summary: A transactional software package manager -License: GPL-3.0-only +License: GPLv3 URL: https://%{provider_prefix} Source0: https://%{provider_prefix}/releases/download/%{version}/%{name}_%{version}.no-vendor.tar.xz Source1: https://%{provider_prefix}/releases/download/%{version}/%{name}_%{version}.only-vendor.tar.xz @@ -117,11 +112,6 @@ Requires: fuse Requires: ((squashfuse and fuse) or kmod(squashfs.ko)) %endif -# Require xdelta for delta updates of snap packages. -%if 0%{?fedora} || ( 0%{?rhel} && 0%{?rhel} > 8 ) -Requires: xdelta -%endif - # bash-completion owns /usr/share/bash-completion/completions Requires: bash-completion @@ -137,11 +127,10 @@ Provides: %{name}-login-service%{?_isa} = 1.33 %endif %if ! 0%{?with_bundled} -BuildRequires: golang(go.etcd.io/bbolt) -BuildRequires: golang(github.com/bmatcuk/doublestar/v4) +BuildRequires: golang(github.com/boltdb/bolt) BuildRequires: golang(github.com/coreos/go-systemd/activation) -BuildRequires: golang(github.com/godbus/dbus/v5) -BuildRequires: golang(github.com/godbus/dbus/v5/introspect) +BuildRequires: golang(github.com/godbus/dbus) +BuildRequires: golang(github.com/godbus/dbus/introspect) BuildRequires: golang(github.com/gorilla/mux) BuildRequires: golang(github.com/jessevdk/go-flags) BuildRequires: golang(github.com/juju/ratelimit) @@ -164,7 +153,6 @@ BuildRequires: golang(gopkg.in/tomb.v2) BuildRequires: golang(gopkg.in/yaml.v2) BuildRequires: golang(gopkg.in/yaml.v3) %endif -BuildRequires: go-rpm-macros %description Snappy is a modern, cross-distribution, transactional package manager @@ -172,11 +160,9 @@ designed for working with self-contained, immutable packages. %package -n snap-confine Summary: Confinement system for snap applications -License: GPL-3.0-only +License: GPLv3 BuildRequires: autoconf -BuildRequires: autoconf-archive BuildRequires: automake -BuildRequires: make BuildRequires: libtool BuildRequires: gcc BuildRequires: gettext @@ -211,7 +197,7 @@ the started snap applications. %package selinux Summary: SELinux module for snapd -License: GPL-2.0-or-later +License: GPLv2+ BuildArch: noarch BuildRequires: selinux-policy BuildRequires: selinux-policy-devel @@ -232,21 +218,18 @@ BuildArch: noarch %endif %if ! 0%{?with_bundled} -Requires: golang(github.com/bmatcuk/doublestar/v4) +Requires: golang(github.com/boltdb/bolt) Requires: golang(github.com/coreos/go-systemd/activation) -Requires: golang(github.com/godbus/dbus/v5) -Requires: golang(github.com/godbus/dbus/v5/introspect) +Requires: golang(github.com/godbus/dbus) +Requires: golang(github.com/godbus/dbus/introspect) Requires: golang(github.com/gorilla/mux) Requires: golang(github.com/jessevdk/go-flags) Requires: golang(github.com/juju/ratelimit) Requires: golang(github.com/kr/pretty) Requires: golang(github.com/kr/text) -Requires: golang(github.com/mattn/go-runewidth) Requires: golang(github.com/mvo5/goconfigparser) -Requires: golang(github.com/rivo/uniseg) Requires: golang(github.com/seccomp/libseccomp-golang) Requires: golang(github.com/snapcore/go-gettext) -Requires: golang(go.etcd.io/bbolt) Requires: golang(golang.org/x/crypto/openpgp/armor) Requires: golang(golang.org/x/crypto/openpgp/packet) Requires: golang(golang.org/x/crypto/sha3) @@ -263,21 +246,19 @@ Requires: golang(gopkg.in/yaml.v3) %else # These Provides are unversioned because the sources in # the bundled tarball are unversioned (they go by git commit) -Provides: bundled(golang(github.com/bmatcuk/doublestar/v4)) +# *sigh*... I hate golang... +Provides: bundled(golang(github.com/snapcore/bolt)) Provides: bundled(golang(github.com/coreos/go-systemd/activation)) -Provides: bundled(golang(github.com/godbus/dbus/v5)) -Provides: bundled(golang(github.com/godbus/dbus/v5/introspect)) +Provides: bundled(golang(github.com/godbus/dbus)) +Provides: bundled(golang(github.com/godbus/dbus/introspect)) Provides: bundled(golang(github.com/gorilla/mux)) Provides: bundled(golang(github.com/jessevdk/go-flags)) Provides: bundled(golang(github.com/juju/ratelimit)) Provides: bundled(golang(github.com/kr/pretty)) Provides: bundled(golang(github.com/kr/text)) -Provides: bundled(golang(github.com/mattn/go-runewidth)) Provides: bundled(golang(github.com/mvo5/goconfigparser)) -Provides: bundled(golang(github.com/rivo/uniseg)) Provides: bundled(golang(github.com/seccomp/libseccomp-golang)) Provides: bundled(golang(github.com/snapcore/go-gettext)) -Provides: bundled(golang(go.etcd.io/bbolt)) Provides: bundled(golang(golang.org/x/crypto/openpgp/armor)) Provides: bundled(golang(golang.org/x/crypto/openpgp/packet)) Provides: bundled(golang(golang.org/x/crypto/sha3)) @@ -338,6 +319,7 @@ Provides: golang(%{import_path}/desktop/notification) = %{version}-%{releas Provides: golang(%{import_path}/desktop/notification/notificationtest) = %{version}-%{release} Provides: golang(%{import_path}/dirs) = %{version}-%{release} Provides: golang(%{import_path}/docs) = %{version}-%{release} +Provides: golang(%{import_path}/errtracker) = %{version}-%{release} Provides: golang(%{import_path}/features) = %{version}-%{release} Provides: golang(%{import_path}/gadget) = %{version}-%{release} Provides: golang(%{import_path}/gadget/edition) = %{version}-%{release} @@ -484,120 +466,71 @@ providing packages with %{import_path} prefix. %prep %if ! 0%{?with_bundled} %setup -q -# Ensure there's no bundled stuff accidentally leaking in... -rm -rf vendor c-vendor %else # Extract each tarball properly %setup -q -D -b 1 %endif # Apply patches %autopatch -p1 -# systemd on EL8 does not recognize RestartMode -# https://bugzilla.redhat.com/show_bug.cgi?id=2315759 -%if 0%{?el8} -sed -i -e '/^RestartMode=/d' data/systemd/snapd.service.in -%endif %build +# We don't want/need squashfuse in the rpm, as it's available in Fedora and EPEL +sed -e 's:_ "github.com/snapcore/squashfuse"::g' -i systemd/systemd.go # Build snapd mkdir -p src/github.com/snapcore ln -s ../../../ src/github.com/snapcore/snapd export GOPATH=$(pwd):%{gopath} -# FIXME: move spec file really to a go.mod world instead of this hack +# remove the mod file, we are building without go modules support rm -f go.mod export GO111MODULE=off -# Ensure we do not pass -mod=foo argument to go, as we disable modules and go -# does not allow us to do both. -sed -e 's/-mod=readonly//g' -e 's/-mod=vendor//g' packaging/snapd2.mk # Generate version files -cat <snapdtool/version_generated.go -package snapdtool +./mkversion.sh "%{version}-%{release}" -func init() { - Version = "%{version}-%{release}" -} -EOF - -cat <cmd/VERSION -%{version}-%{release} -EOF - -cat <data/info -VERSION=%{version}-%{release} -SNAPD_APPARMOR_REEXEC=0 -SNAPD_ASSERTS_FORMATS='{"account-key":1,"snap-declaration":6,"system-user":2}' -EOF +# see https://github.com/gofed/go-macros/blob/master/rpm/macros.d/macros.go-compilers-golang +BUILDTAGS= +%if 0%{?with_test_keys} +BUILDTAGS="withtestkeys nosecboot" +%else +BUILDTAGS="nosecboot" +%endif %if ! 0%{?with_bundled} # We don't need the snapcore fork for bolt - it is just a fix on ppc -sed -e "s:github.com/snapcore/bolt:github.com/boltdb/bolt:g" -i advisor/*.go +sed -e "s:github.com/snapcore/bolt:github.com/boltdb/bolt:g" -i advisor/*.go errtracker/*.go %endif +# We have to build snapd first to prevent the build from +# building various things from the tree without additional +# set tags. +%gobuild -o bin/snapd $GOFLAGS %{import_path}/cmd/snapd +BUILDTAGS="${BUILDTAGS} nomanagers" +%gobuild -o bin/snap $GOFLAGS %{import_path}/cmd/snap +%gobuild -o bin/snap-failure $GOFLAGS %{import_path}/cmd/snap-failure + +# To ensure things work correctly with base snaps, +# snap-exec, snap-update-ns, and snapctl need to be built statically +( %if 0%{?rhel} >= 7 # since RH Developer tools 2018.4 (and later releases), # the go-toolset module is built with FIPS compliance that # defaults to using libcrypto.so which gets loaded at runtime via dlopen(), # disable that functionality for statically built binaries - EXTRA_TAGS="${EXTRA_TAGS} no_openssl" + BUILDTAGS="${BUILDTAGS} no_openssl" %endif + %gobuild_static -o bin/snap-exec $GOFLAGS %{import_path}/cmd/snap-exec + %gobuild_static -o bin/snap-update-ns $GOFLAGS %{import_path}/cmd/snap-update-ns + %gobuild_static -o bin/snapctl $GOFLAGS %{import_path}/cmd/snapctl +) -# Generate snapd.defines.mk, this file is included by snapd.mk. It contains a -# number of variable definitions that are set based on their RPM equivalents. -# Since we can apply any conditional overrides here in the spec file we can -# maintain one consistent set of variables across the spec and makefile worlds. -cat >snapd.defines.mk <<__DEFINES__ -# This file is generated by Fedora's snapd.spec -# Directory variables. -prefix = %{_prefix} -bindir = %{_bindir} -sbindir = %{_sbindir} -libexecdir = %{_libexecdir} -mandir = %{_mandir} -datadir = %{_datadir} -localstatedir = %{_localstatedir} -sharedstatedir = %{_sharedstatedir} -unitdir = %{_unitdir} -builddir = %{_builddir} -# Build configuration -with_core_bits = 0 -with_alt_snap_mount_dir = 1 -with_apparmor = 1 -with_testkeys = %{with_test_keys} -with_vendor = %{with_bundled} -# follow what %%gobuild does -EXTRA_GO_BUILD_FLAGS = -v -x -compiler gc -EXTRA_GO_LDFLAGS = -linkmode external -extldflags '%__global_ldflags' -EXTRA_GO_STATIC_LDFLAGS = -linkmode external -extldflags '%__global_ldflags -static' -EXTRA_GO_BUILD_TAGS = rpm_crashtraceback $EXTRA_TAGS -__DEFINES__ - -# Generate version files - -cat <snapdtool/version_generated.go -package snapdtool - -// generated by snapd.spec; do not edit - -func init() { - Version = "%{version}-%{release}" -} -EOF - -cat <cmd/VERSION -%{version}-%{release} -EOF - -# FIXME: We paste a fixed string but we should run some go code to generate the -# real value. We don't want to do that as that code needs to use host's -# libraries without talking to the proxy. -cat <data/info -SNAPD_APPARMOR_REEXEC=0 -SNAPD_ASSERTS_FORMATS='{"account-key":1,"snap-declaration":6,"system-user":2}' -EOF +%if 0%{?rhel} +# There's no static link library for libseccomp in RHEL/CentOS... +sed -e "s/-Bstatic -lseccomp/-Bstatic/g" -i cmd/snap-seccomp/*.go +%endif +%gobuild -o bin/snap-seccomp $GOFLAGS %{import_path}/cmd/snap-seccomp ( %if 0%{?rhel} == 7 @@ -618,6 +551,7 @@ EOF # Build snap-confine pushd ./cmd autoreconf --force --install --verbose +# FIXME: add --enable-caps-over-setuid as soon as possible (setuid discouraged!) %configure \ --disable-apparmor \ --enable-selinux \ @@ -633,11 +567,6 @@ autoreconf --force --install --verbose %make_build %{!?with_valgrind:HAVE_VALGRIND=} popd -# Build snap, snapd and other tools -%make_build -f packaging/snapd2.mk \ - SNAPD_DEFINES_DIR=$PWD \ - all - # Build systemd units, dbus services, and env files pushd ./data make BINDIR="%{_bindir}" LIBEXECDIR="%{_libexecdir}" DATADIR="%{_datadir}" \ @@ -660,12 +589,10 @@ install -d -p %{buildroot}%{_sysconfdir}/profile.d install -d -p %{buildroot}%{_sysconfdir}/sysconfig install -d -p %{buildroot}%{_sharedstatedir}/snapd/assertions install -d -p %{buildroot}%{_sharedstatedir}/snapd/cookie -install -d -p %{buildroot}%{_sharedstatedir}/snapd/cgroup install -d -p %{buildroot}%{_sharedstatedir}/snapd/dbus-1/services install -d -p %{buildroot}%{_sharedstatedir}/snapd/dbus-1/system-services install -d -p %{buildroot}%{_sharedstatedir}/snapd/desktop/applications install -d -p %{buildroot}%{_sharedstatedir}/snapd/device -install -d -p %{buildroot}%{_sharedstatedir}/snapd/environment install -d -p %{buildroot}%{_sharedstatedir}/snapd/hostfs install -d -p %{buildroot}%{_sharedstatedir}/snapd/inhibit install -d -p %{buildroot}%{_sharedstatedir}/snapd/lib/gl @@ -682,10 +609,24 @@ install -d -p %{buildroot}%{_datadir}/polkit-1/actions install -d -p %{buildroot}%{_datadir}/selinux/devel/include/contrib install -d -p %{buildroot}%{_datadir}/selinux/packages +# Install snap and snapd +install -p -m 0755 bin/snap %{buildroot}%{_bindir} +install -p -m 0755 bin/snap-exec %{buildroot}%{_libexecdir}/snapd +install -p -m 0755 bin/snap-failure %{buildroot}%{_libexecdir}/snapd +install -p -m 0755 bin/snapd %{buildroot}%{_libexecdir}/snapd +install -p -m 0755 bin/snap-update-ns %{buildroot}%{_libexecdir}/snapd +install -p -m 0755 bin/snap-seccomp %{buildroot}%{_libexecdir}/snapd +# Ensure /usr/bin/snapctl is a symlink to /usr/libexec/snapd/snapctl +install -p -m 0755 bin/snapctl %{buildroot}%{_libexecdir}/snapd/snapctl +ln -sf %{_libexecdir}/snapd/snapctl %{buildroot}%{_bindir}/snapctl + # Install SELinux module install -p -m 0644 data/selinux/snappy.if %{buildroot}%{_datadir}/selinux/devel/include/contrib install -p -m 0644 data/selinux/snappy.pp.bz2 %{buildroot}%{_datadir}/selinux/packages +# Install snap(8) man page +bin/snap help --man > %{buildroot}%{_mandir}/man8/snap.8 + # Install the "info" data file with snapd version install -m 644 -D data/info %{buildroot}%{_libexecdir}/snapd/info @@ -704,6 +645,8 @@ pushd ./cmd chmod 0755 %{buildroot}%{_sharedstatedir}/snapd/void # We don't use AppArmor rm -rfv %{buildroot}%{_sysconfdir}/apparmor.d +# ubuntu-core-launcher is dead +rm -fv %{buildroot}%{_bindir}/ubuntu-core-launcher popd # Install all systemd and dbus units, and env files @@ -714,12 +657,9 @@ pushd ./data SNAP_MOUNT_DIR="%{_sharedstatedir}/snapd/snap" \ SNAPD_ENVIRONMENT_FILE="%{_sysconfdir}/sysconfig/snapd" popd - -# Install snap, snapd and tools -# auto-remove unnecessary files and service units -%make_install -f packaging/snapd2.mk \ - SNAPD_DEFINES_DIR=$PWD \ - install +# Sudo tweaks do not work anyway, see +# https://bugzilla.redhat.com/show_bug.cgi?id=1691996 for more details +rm -rfv %{buildroot}%{_sysconfdir}/sudoers.d %if 0%{?rhel} == 7 # Install kernel tweaks @@ -728,19 +668,29 @@ install -m 644 -D data/sysctl/rhel7-snap.conf %{buildroot}%{_sysctldir}/99-snap. %endif # Remove snappy core specific units -rm -fv %{buildroot}%{_unitdir}/snapd.failure.service +rm -fv %{buildroot}%{_unitdir}/snapd.system-shutdown.service +rm -fv %{buildroot}%{_unitdir}/snapd.snap-repair.* +rm -fv %{buildroot}%{_unitdir}/snapd.core-fixup.* +rm -fv %{buildroot}%{_unitdir}/snapd.recovery-chooser-trigger.service -# Remove gpio-chardev ordering target -rm -f %{buildroot}%{_unitdir}/snapd.gpio-chardev-setup.target +# Remove snappy core specific scripts and binaries +rm %{buildroot}%{_libexecdir}/snapd/snapd.core-fixup.sh +rm %{buildroot}%{_libexecdir}/snapd/system-shutdown + +# Remove snapd apparmor service +rm -f %{buildroot}%{_unitdir}/snapd.apparmor.service +rm -f %{buildroot}%{_libexecdir}/snapd/snapd-apparmor + +# Remove prompt services +rm %{buildroot}%{_unitdir}/snapd.aa-prompt-listener.service +rm %{buildroot}%{_userunitdir}/snapd.aa-prompt-ui.service +rm %{buildroot}%{_datadir}/dbus-1/services/io.snapcraft.Prompt.service + +# Install Polkit configuration +install -m 644 -D data/polkit/io.snapcraft.snapd.policy %{buildroot}%{_datadir}/polkit-1/actions # Disable re-exec by default -mkdir -p %{buildroot}%{_sysconfdir}/sysconfig -cat <<'EOF' > %{buildroot}%{_sysconfdir}/sysconfig/snapd -# Snapd daemon can reexec into the binary from the snapd snap, if -# it is newer than the version installed through distro packaging. -# Set to 1 to enable reexec. The default is 0. -#SNAP_REEXEC=0 -EOF +echo 'SNAP_REEXEC=0' > %{buildroot}%{_sysconfdir}/sysconfig/snapd # Create state.json and the README file to be ghosted touch %{buildroot}%{_sharedstatedir}/snapd/state.json @@ -782,20 +732,24 @@ sort -u -o devel.file-list devel.file-list %check for binary in snap-exec snap-update-ns snapctl; do - ldd %{_builddir}/$binary 2>&1 | grep 'not a dynamic executable' + ldd bin/$binary 2>&1 | grep 'not a dynamic executable' done # snapd tests %if 0%{?with_check} && 0%{?with_unit_test} && 0%{?with_devel} -%make_build -f packaging/snapd2.mk \ - SNAPD_DEFINES_DIR=$PWD \ - check +%if ! 0%{?with_bundled} +export GOPATH=%{buildroot}/%{gopath}:%{gopath} +%else +export GOPATH=%{buildroot}/%{gopath}:$(pwd)/Godeps/_workspace:%{gopath} +%endif +export GO111MODULE=off +%gotest %{import_path}/... %endif # snap-confine tests (these always run!) -make -C cmd -k check -# and data files -make -C data -k check +pushd ./cmd +make check +popd %files #define license tag if not already defined @@ -812,9 +766,9 @@ make -C data -k check %{_libexecdir}/snapd/snapctl %{_libexecdir}/snapd/snapd %{_libexecdir}/snapd/snap-exec +%{_libexecdir}/snapd/snap-failure %{_libexecdir}/snapd/info %{_libexecdir}/snapd/snap-mgmt -%{_libexecdir}/snapd/snapd-apparmor %{_libexecdir}/snapd/snap-mgmt-selinux %{_mandir}/man8/snap.8* %{_datadir}/applications/snap-handle-link.desktop @@ -828,8 +782,9 @@ make -C data -k check %{_systemd_system_env_generator_dir}/snapd-env-generator %{_unitdir}/snapd.socket %{_unitdir}/snapd.service +%{_unitdir}/snapd.autoimport.service +%{_unitdir}/snapd.failure.service %{_unitdir}/snapd.seeded.service -%{_unitdir}/snapd.apparmor.service %{_unitdir}/snapd.mounts.target %{_unitdir}/snapd.mounts-pre.target %{_userunitdir}/snapd.session-agent.service @@ -849,7 +804,6 @@ make -C data -k check %dir %{_sharedstatedir}/snapd %dir %{_sharedstatedir}/snapd/assertions %dir %{_sharedstatedir}/snapd/cookie -%dir %{_sharedstatedir}/snapd/cgroup %dir %{_sharedstatedir}/snapd/dbus-1 %dir %{_sharedstatedir}/snapd/dbus-1/services %dir %{_sharedstatedir}/snapd/dbus-1/system-services @@ -866,19 +820,13 @@ make -C data -k check %dir %{_sharedstatedir}/snapd/mount %dir %{_sharedstatedir}/snapd/seccomp %dir %{_sharedstatedir}/snapd/seccomp/bpf -%ghost %{_sharedstatedir}/snapd/seccomp/bpf/global.bin %dir %{_sharedstatedir}/snapd/snaps %dir %{_sharedstatedir}/snapd/snap %ghost %dir %{_sharedstatedir}/snapd/snap/bin -%ghost %{_sharedstatedir}/snapd/state.json -%ghost %{_sharedstatedir}/snapd/system-key -%ghost %{_sharedstatedir}/snapd/snap/bin -%ghost %{_sharedstatedir}/snapd/snap/README %dir %{_localstatedir}/cache/snapd -%ghost %{_localstatedir}/cache/snapd/commands -%ghost %{_localstatedir}/cache/snapd/names -%ghost %{_localstatedir}/cache/snapd/sections %dir %{_localstatedir}/snap +%ghost %{_sharedstatedir}/snapd/state.json +%ghost %{_sharedstatedir}/snapd/snap/README # this is typically owned by zsh, but we do not want to explicitly require zsh %dir %{_datadir}/zsh %dir %{_datadir}/zsh/site-functions @@ -889,9 +837,9 @@ make -C data -k check %doc cmd/snap-confine/PORTING %license COPYING %dir %{_libexecdir}/snapd -%caps(%{snap_confine_caps}) %{_libexecdir}/snapd/snap-confine -%{_libexecdir}/snapd/snap-confine.caps -%{_libexecdir}/snapd/snap-confine.v2-only.caps +# For now, we can't use caps +# FIXME: Switch to "%%attr(0755,root,root) %%caps(cap_sys_admin=pe)" asap! +%attr(4755,root,root) %{_libexecdir}/snapd/snap-confine %{_libexecdir}/snapd/snap-device-helper %{_libexecdir}/snapd/snap-discard-ns %{_libexecdir}/snapd/snap-gdb-shim @@ -990,1517 +938,8 @@ if [ $1 -eq 0 ]; then %selinux_relabel_post fi + %changelog -* Thu Nov 13 2025 Ernest Lotter -- New upstream release 2.72 - - FDE: support replacing TPM protected keys at runtime via the - /v2/system-volumes endpoint - - FDE: support secboot preinstall check fix actions for 25.10+ - hybrid installs via the /v2/system/{label} endpoint - - FDE: tweak polkit message to remove jargon - - FDE: ensure proper sealing with kernel command line defaults - - FDE: provide generic reseal function - - FDE: support using OPTEE for protecting keys, as an alternative to - existing fde-setup hooks (Ubuntu Core only) - - Confdb: 'snapctl get --view' supports passing default values - - Confdb: content sub-rules in confdb-schemas inherit their parent - rule's "access" - - Confdb: make confdb error kinds used in API more generic - - Confdb: fully support lists and indexed paths (including unset) - - Prompting: add notice backend for prompting types (unused for now) - - Prompting: include request cgroup in prompt - - Prompting: handle unsupported xattrs - - Prompting: add permission mapping for the camera interface - - Notices: read notices from state without state lock - - Notices: add methods to get notice fields and create, reoccur, and - deepcopy notice - - Notices: add notice manager to coordinate separate notice backends - - Notices: support draining notices from state when notice backend - registered as producer of a particular notice type - - Notices: query notice manager from daemon instead of querying - state for notices directly - - Packaging: Ubuntu | ignore .git directory - - Packaging: FIPS | bump deb Go FIPS to 1.23 - - Packaging: snap | bump FIPS toolchain to 1.23 - - Packaging: debian | sync most upstream changes - - Packaging: debian-sid | depends on libcap2-bin for postint - - Packaging: Fedora | drop fakeroot - - Packaging: snap | modify snapd.mk to pass build tags when running - unit tests - - Packaging: snap | modify snapd.mk to pass nooptee build tag - - Packaging: modify Makefile.am to fix snap-confine install profile - with 'make hack' - - Packaging: modify Makefile.am to fix out-of-tree use of 'make - hack' - - LP: #2122054 Snap installation: skip snap icon download when - running in a cloud or using a proxy store - - Snap installation: add timeout to http client when downloading - snap icon - - Snap installation: use http(s) proxy for icon downloads - - LP: #2117558 snap-confine: fix error message with /root/snap not - accessible - - snap-confine: fix non-suid limitation by switching to root:root to - operate v1 freezer - - core-initrd: do not use writable-paths when not available - - core-initrd: remove debian folder - - LP: #1916244 Interfaces: gpio-chardev | re-enable the gpio-chardev - interface now with the more robust gpio-aggregator configfs kernel - interface - - Interfaces: gpio-chardev | exclusive snap connections, raise a - conflict when both gpio-chardev and gpio are connected - - Interfaces: gpio-chardev | fix gpio-aggregator module load order - - Interfaces: ros-snapd-support | grant access to /v2/changes - - Interfaces: uda-driver-libs, egl-driver-libs, gbm-driver-libs, - opengl-driver-libs, opengles-driver-libs | new interfaces to - support nvidia driver components - - Interfaces: microstack-support | allow DPDK (hugepage related - permissions) - - Interfaces: system-observe | allow reading additional files in - /proc, needed by node-exporter - - Interfaces: u2f | add Cano Key, Thesis FIDO2 BioFP+ Security Key - and Kensington VeriMark DT Fingerprint Key to device list - - Interfaces: snap-interfaces-requests-control | allow shell API - control - - Interfaces: fwupd | allow access to Intel CVS sysfs - - Interfaces: hardware-observe | allow read access to Kernel - Samepage Merging (KSM) - - Interfaces: xilinx-dma | support Multi Queue DMA (QDMA) IP - - Interfaces: spi | relax sysfs permission rules to allow access to - SPI device node attributes - - Interfaces: content | introduce compatibility label - - LP: #2121238 Interfaces: do not expose Kerberos tickets for - classic snaps - - Interfaces: ssh-public-keys | allow ro access to public host keys - with ssh-key - - Interfaces: Modify AppArmor template to allow listing systemd - credentials and invoking systemd-creds - - Interfaces: modify AppArmor template with workarounds for Go 1.35 - cgroup aware GOMAXPROCS - - Interfaces: modify seccomp template to allow landlock_* - - Prevent snap hooks from running while relevant snaps are unlinked - - Make refreshes wait before unlinking snaps if running hooks can be - affected - - Fix systemd unit generation by moving "WantedBy=" from section - "unit" to "install" - - Add opt-in logging support for snap-update-ns - - Unhide 'snap help' sign and export-key under Development category - - LP: #2117121 Cleanly support socket activation for classic snap - - Add architecture to 'snap version' output - - Add 'snap debug api' option to disable authentication through - auth.json - - Show grade in notes for 'snap info --verbose' - - Fix preseeding failure due to scan-disk issue on RPi - - Support 'snap debug api' queries to user session agents - - LP: #2112626 Improve progress reporting for snap install/refresh - - Drop legacy BAMF_DESKTOP_FILE_HINT in desktop files - - Fix /v2/apps error for root user when user services are present - - LP: #2114704 Extend output to indicate when snap data snapshot was - created during remove - - Improve how we handle emmc volumes - - Improve handling of system-user extra assertions - -* Fri Oct 10 2025 Alejandro Sáez - 2.71-1 -- rebuild - -* Fri Aug 22 2025 Ernest Lotter -- New upstream release 2.71 - - FDE: auto-repair when recovery key is used - - FDE: revoke keys on shim update - - FDE: revoke old TPM keys when dbx has been updated - - FDE: do not reseal FDE hook keys every time - - FDE: store keys in the kernel keyring when installing from initrd - - FDE: allow disabled DMA on Core - - FDE: snap-bootstrap: do not check for partition in scan-disk on - CVM - - FDE: support secboot preinstall check for 25.10+ hybrid installs - via the /v2/system/{label} endpoint - - FDE: support generating recovery key at install time via the - /v2/systems/{label} endpoint - - FDE: update passphrase quality check at install time via the - /v2/systems/{label} endpoint - - FDE: support replacing recovery key at runtime via the new - /v2/system-volumes endpoint - - FDE: support checking recovery keys at runtime via the /v2/system- - volumes endpoint - - FDE: support enumerating keyslots at runtime via the /v2/system- - volumes endpoint - - FDE: support changing passphrase at runtime via the /v2/system- - volumes endpoint - - FDE: support passphrase quality check at runtime via the - /v2/system-volumes endpoint - - FDE: update secboot to revision 3e181c8edf0f - - Confdb: support lists and indexed paths on read and write - - Confdb: alias references must be wrapped in brackets - - Confdb: support indexed paths in confdb-schema assertion - - Confdb: make API errors consistent with options - - Confdb: fetch confdb-schema assertion on access - - Confdb: prevent --previous from being used in read-side hooks - - Components: fix snap command with multiple components - - Components: set revision of seed components to x1 - - Components: unmount extra kernel-modules components mounts - - AppArmor Prompting: add lifespan "session" for prompting rules - - AppArmor Prompting: support restoring prompts after snapd restart - - AppArmor Prompting: limit the extra information included in probed - AppArmor features and system key - - Notices: refactor notice state internals - - SELinux: look for restorecon/matchpathcon at all known locations - rather than current PATH - - SELinux: update policy to allow watching cgroups (for RAA), and - talking to user session agents (service mgmt/refresh) - - Refresh App Awareness: Fix unexpected inotify file descriptor - cleanup - - snap-confine: workaround for glibc fchmodat() fallback and handle - ENOSYS - - snap-confine: add support for host policy for limiting users able - to run snaps - - LP: #2114923 Reject system key mismatch advise when not yet seeded - - Use separate lanes for essential and non-essential snaps during - seeding and allow non-essential installs to retry - - Fix bug preventing remodel from core18 to core18 when snapd snap - is unchanged - - LP: #2112551 Make removal of last active revision of a snap equal - to snap remove - - LP: #2114779 Allow non-gpt in fallback mode to support RPi - - Switch from using systemd LogNamespace to manually controlled - journal quotas - - Change snap command trace logging to only log the command names - - Grant desktop-launch access to /v2/snaps - - Update code for creating the snap journal stream - - Switch from using core to snapd snap for snap debug connectivity - - LP: #2112544 Fix offline remodel case where we switched to a - channel without an actual refresh - - LP: #2112332 Exclude snap/snapd/preseeding when generating preseed - tarball - - LP: #1952500 Fix snap command progress reporting - - LP: #1849346 Interfaces: kerberos-tickets | add new interface - - Interfaces: u2f | add support for Thetis Pro - - Interfaces: u2f | add OneSpan device and fix older device - - Interfaces: pipewire, audio-playback | support pipewire as system - daemon - - Interfaces: gpg-keys | allow access to GPG agent sockets - - Interfaces: usb-gadget | add new interface - - Interfaces: snap-fde-control, firmware-updater-support | add new - interfaces to support FDE - - Interfaces: timezone-control | extend to support timedatectl - varlink - - Interfaces: cpu-control | fix rules for accessing IRQ sysfs and - procfs directories - - Interfaces: microstack-support | allow SR-IOV attachments - - Interfaces: modify AppArmor template to allow snaps to read their - own systemd credentials - - Interfaces: posix-mq | allow stat on /dev/mqueue - - LP: #2098780 Interfaces: log-observe | add capability - dac_read_search - - Interfaces: block-devices | allow access to ZFS pools and datasets - - LP: #2033883 Interfaces: block-devices | opt-in access to - individual partitions - - Interfaces: accel | add new interface to support accel kernel - subsystem - - Interfaces: shutdown | allow client to bind on its side of dbus - socket - - Interfaces: modify seccomp template to allow pwritev2 - - Interfaces: modify AppArmor template to allow reading - /proc/sys/fs/nr_open - - Packaging: drop snap.failure service for openSUSE - - Packaging: add SELinux support for openSUSE - - Packaging: disable optee when using nooptee build tag - - Packaging: add support for static PIE builds in snapd.mk, drop - pie.patch from openSUSE - - Packaging: add libcap2-bin runtime dependency for ubuntu-16.04 - - Packaging: use snapd.mk for packaging on Fedora - - Packaging: exclude .git directory - - Packaging: fix DPKG_PARSECHANGELOG assignment - - Packaging: fix building on Fedora with dpkg installed - -* Fri Aug 15 2025 Maxwell G - 2.70-3 -- Rebuild for golang-1.25.0 - -* Fri Jul 25 2025 Fedora Release Engineering - 2.70-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild - -* Tue Jun 03 2025 Ernest Lotter -- New upstream release 2.70 - - FDE: Fix reseal with v1 hook key format - - FDE: set role in TPM keys - - AppArmor prompting (experimental): add handling for expired - requests or listener in the kernel - - AppArmor prompting: log the notification protocol version - negotiated with the kernel - - AppArmor prompting: implement notification protocol v5 (manually - disabled for now) - - AppArmor prompting: register listener ID with the kernel and - resend notifications after snapd restart (requires protocol v5+) - - AppArmor prompting: select interface from metadata tags and set - request interface accordingly (requires protocol v5+) - - AppArmor prompting: include request PID in prompt - - AppArmor prompting: move the max prompt ID file to a subdirectory - of the snap run directory - - AppArmor prompting: avoid race between closing/reading socket fd - - Confdb (experimental): make save/load hooks mandatory if affecting - ephemeral - - Confdb: clear tx state on failed load - - Confdb: modify 'snap sign' formats JSON in assertion bodies (e.g. - confdb-schema) - - Confdb: add NestedEphemeral to confdb schemas - - Confdb: add early concurrency checks - - Simplify building Arch package - - Enable snapd.apparmor on Fedora - - Build snapd snap with libselinux - - Emit snapd.apparmor warning only when using apparmor backend - - When running snap, on system key mismatch e.g. due to network - attached HOME, trigger and wait for a security profiles - regeneration - - Avoid requiring state lock to get user, warnings, or pending - restarts when handling API requests - - Start/stop ssh.socket for core24+ when enabling/disabling the ssh - service - - Allow providing a different base when overriding snap - - Modify snap-bootstrap to mount snapd snap directly to /snap - - Modify snap-bootstrap to mount /lib/{modules,firmware} from snap - as fallback - - Modify core-initrd to use systemctl reboot instead of /sbin/reboot - - Copy the initramfs 'manifest-initramfs.yaml' to initramfs file - creation directory so it can be copied to the kernel snap - - Build the early initrd from installed ucode packages - - Create drivers tree when remodeling from UC20/22 to UC24 - - Load gpio-aggregator module before the helper-service needs it - - Run 'systemctl start' for mount units to ensure they are run also - when unchanged - - Update godbus version to 'v5 v5.1.0' - - Add support for POST to /v2/system-info with system-key-mismatch - indication from the client - - Add 'snap sign --update-timestamp' flag to update timestamp before - signing - - Add vfs support for snap-update-ns to use to simulate and evaluate - mount sequences - - Add refresh app awareness debug logging - - Add snap-bootstrap scan-disk subcommand to be called from udev - - Add feature to inject proxy store assertions in build image - - Add OP-TEE bindings, enable by default in ARM and ARM64 builds - - Fix systemd dependency options target to go under 'unit' section - - Fix snap-bootstrap reading kernel snap instead of base resulting - in bad modeenv - - Fix a regression during seeding when using early-config - - LP: #2107443 reset SHELL to /bin/bash in non-classic snaps - - Make Azure kernels reboot upon panic - - Fix snap-confine to not drop capabilities if the original user is - already root - - Fix data race when stopping services - - Fix task dependency issue by temporarily disable re-refresh on - prerequisite updates - - Fix compiling against op-tee on armhf - - Fix dbx update when not using FDE - - Fix potential validation set deadlock due to bases waiting on - snaps - - LP: #2104066 Only cancel notices requests on stop/shutdown - - Interfaces: bool-file | fix gpio glob pattern as required for - '[XXXX]*' format - - Interfaces: system-packages-doc | allow access to - /usr/local/share/doc - - Interfaces: ros-snapd-support interface | added new interface - - Interfaces: udisks2 | allow chown capability - - Interfaces: system-observe | allow reading cpu.max - - Interfaces: serial-port | add ttyMAXX to allowed list - - Interfaces: modified seccomp template to disallow - 'O_NOTIFICATION_PIPE' - - Interfaces: fwupd | add support for modem-manager plugin - - Interfaces: gpio-chardev | make unsupported and remove - experimental flag to hide this feature until gpio-aggregator is - available - - Interfaces: hardware-random | fix udev match rule - - Interfaces: timeserver-control | extend to allow timedatectl - timesync commands - - Interfaces: add symlinks backend - - Interfaces: system key mismatch handling - -* Tue Apr 08 2025 Ernest Lotter -- New upstream release 2.69 - - FDE: re-factor listing of the disks based on run mode model and - model to correctly resolve paths - - FDE: run snapd from snap-failure with the correct keyring mode - - Snap components: allow remodeling back to an old snap revision - that includes components - - Snap components: fix remodel to a kernel snap that is already - installed on the system, but not the current kernel due to a - previous remodel. - - Snap components: fix for snapctl inputs that can crash snapd - - Confdb (experimental): load ephemeral data when reading data via - snapctl get - - Confdb (experimental): load ephemeral data when reading data via - snap get - - Confdb (experimental): rename {plug}-view-changed hook to observe- - view-{plug} - - Confdb (experimental): rename confdb assertion to confdb-schema - - Confdb (experimental): change operator grouping in confdb-control - assertion - - Confdb (experimental): add confdb-control API - - AppArmor: extend the probed features to include the presence of - files, as well as directories - - AppArmor prompting (experimental): simplify the listener - - AppArmor metadata tagging (disabled): probe parser support for - tags - - AppArmor metadata tagging (disabled): implement notification - protocol v5 - - Confidential VMs: sysroot.mount is now dynamically created by - snap-bootstrap instead of being a static file in the initramfs - - Confidential VMs: Add new implementation of snap integrity API - - Non-suid snap-confine: first phase to replace snap-confine suid - with capabilities to achieve the required permissions - - Initial changes for dynamic security profiles updates - - Provide snap icon fallback for /v2/icons without requiring network - access at runtime - - Add eMMC gadget update support - - Support reexec when using /usr/libexec/snapd on the host (Arch - Linux, openSUSE) - - Auto detect snap mount dir location on unknown distributions - - Modify snap-confine AppArmor template to allow all glibc HWCAPS - subdirectories to prevent launch errors - - LP: #2102456 update secboot to bf2f40ea35c4 and modify snap- - bootstrap to remove usage of go templates to reduce size by 4MB - - Fix snap-bootstrap to mount kernel snap from - /sysroot/writable/system-data - - LP: #2106121 fix snap-bootstrap busy loop - - Fix encoding of time.Time by using omitzero instead of omitempty - (on go 1.24+) - - Fix setting snapd permissions through permctl for openSUSE - - Fix snap struct json tags typo - - Fix snap pack configure hook permissions check incorrect file mode - - Fix gadget snap reinstall to honor existing sizes of partitions - - Fix to update command line when re-executing a snapd tool - - Fix 'snap validate' of specific missing newline and add error on - missed case of 'snap validate --refresh' without another action - - Workaround for snapd-confine time_t size differences between - architectures - - Disallow pack and install of snapd, base and os with specific - configure hooks - - Drop udev build dependency that is no longer required and add - missing systemd-dev dependency - - Build snap-bootstrap with nomanagers tag to decrease size by 1MB - - Interfaces: polkit | support custom polkit rules - - Interfaces: opengl | LP: #2088456 fix GLX on nvidia when xorg is - confined by AppArmor - - Interfaces: log-observe | add missing udev rule - - Interfaces: hostname-control | fix call to hostnamectl in core24 - - Interfaces: network-control | allow removing created network - namespaces - - Interfaces: scsi-generic | re-enable base declaration for scsi- - generic plug - - Interfaces: u2f | add support for Arculus AuthentiKey - -* Wed Apr 02 2025 Ernest Lotter -- New upstream release 2.68.4 - - Snap components: LP: #2104933 workaround for classic 24.04/24.10 - models that incorrectly specify core22 instead of core24 - - Update build dependencies - -* Mon Mar 10 2025 Ernest Lotter -- New upstream release 2.68.3 - - FDE: LP: #2101834 snapd 2.68+ and snap-bootstrap <2.68 fallback to - old keyring path - - Fix Plucky snapd deb build issue related to /var/lib/snapd/void - permissions - - Fix snapd deb build complaint about ifneq with extra bracket - -* Thu Feb 27 2025 Ernest Lotter -- New upstream release 2.68.2 - - FDE: use boot mode for FDE hooks - - FDE: add snap-bootstrap compatibility check to prevent image - creation with incompatible snapd and kernel snap - - FDE: add argon2 out-of-process KDF support - - FDE: have separate mutex for the sections writing a fresh modeenv - - FDE: LP: #2099709 update secboot to e07f4ae48e98 - - Confdb: support pruning ephemeral data and process alternative - types in order - - core-initrd: look at env to mount directly to /sysroot - - core-initrd: prepare for Plucky build and split out 24.10 - (Oracular) - - Fix missing primed packages in snapd snap manifest - - Interfaces: posix-mq | fix incorrect clobbering of global variable - and make interface more precise - - Interfaces: opengl | add more kernel fusion driver files - -* Mon Feb 24 2025 Ernest Lotter -- New upstream release 2.68.1 - - Fix snap-confine type specifier type mismatch on armhf - -* Thu Feb 13 2025 Ernest Lotter -- New upstream release 2.68 - - FDE: add support for new and more extensible key format that is - unified between TPM and FDE hook - - FDE: add support for adding passphrases during installation - - FDE: update secboot to 30317622bbbc - - Snap components: make kernel components available on firstboot - after either initramfs or ephemeral rootfs style install - - Snap components: mount drivers tree from initramfs so kernel - modules are available in early boot stages - - Snap components: support remodeling to models that contain - components - - Snap components: support offline remodeling to models that contain - components - - Snap components: support creating new recovery systems with - components - - Snap components: support downloading components with 'snap - download' command - - Snap components: support sideloading asserted components - - AppArmor Prompting(experimental): improve version checks and - handling of listener notification protocol for communication with - kernel AppArmor - - AppArmor Prompting(experimental): make prompt replies idempotent, - and have at most one rule for any given path pattern, with - potentially mixed outcomes and lifespans - - AppArmor Prompting(experimental): timeout unresolved prompts after - a period of client inactivity - - AppArmor Prompting(experimental): return an error if a patch - request to the API would result in a rule without any permissions - - AppArmor Prompting(experimental): warn if there is no prompting - client present but prompting is enabled, or if a prompting-related - error occurs during snapd startup - - AppArmor Prompting(experimental): do not log error when converting - empty permissions to AppArmor permissions - - Confdb(experimental): rename registries to confdbs (including API - /v2/registries => /v2/confdb) - - Confdb(experimental): support marking confdb schemas as ephemeral - - Confdb(experimental): add confdb-control assertion and feature - flag - - Refresh App Awareness(experimental): LP: #2089195 prevent - possibility of incorrect notification that snap will quit and - update - - Confidential VMs: snap-bootstrap support for loading partition - information from a manifest file for cloudimg-rootfs mode - - Confidential VMs: snap-bootstrap support for setting up cloudimg- - rootfs as an overlayfs with integrity protection - - dm-verity for essential snaps: add support for snap-integrity - assertion - - Interfaces: modify AppArmor template to allow owner read on - @{PROC}/@{pid}/fdinfo/* - - Interfaces: LP: #2072987 modify AppArmor template to allow using - setpriv to run daemon as non-root user - - Interfaces: add configfiles backend that ensures the state of - configuration files in the filesystem - - Interfaces: add ldconfig backend that exposes libraries coming - from snaps to either the rootfs or to other snaps - - Interfaces: LP: #1712808 LP: 1865503 disable udev backend when - inside a container - - Interfaces: add auditd-support interface that grants audit_control - capability and required paths for auditd to function - - Interfaces: add checkbox-support interface that allows - unrestricted access to all devices - - Interfaces: fwupd | allow access to dell bios recovery - - Interfaces: fwupd | allow access to shim and fallback shim - - Interfaces: mount-control | add mount option validator to detect - mount option conflicts early - - Interfaces: cpu-control | add read access to /sys/kernel/irq/ - - Interfaces: locale-control | changed to be implicit on Ubuntu Core - Desktop - - Interfaces: microstack-support | support for utilizing of AMD SEV - capabilities - - Interfaces: u2f | added missing OneSpan device product IDs - - Interfaces: auditd-support | grant seccomp setpriority - - Interfaces: opengl interface | enable parsing of nvidia driver - information files - - Allow mksquashfs 'xattrs' when packing snap types os, core, base - and snapd as part of work to support non-root snap-confine - - Upstream/downstream packaging changes and build updates - - Improve error logs for malformed desktop files to also show which - desktop file is at fault - - Provide more precise error message when overriding channels with - grade during seed creation - - Expose 'snap prepare-image' validation parameter - - Add snap-seccomp 'dump' command that dumps the filter rules from a - compiled profile - - Add fallback release info location /etc/initrd-release - - Added core-initrd to snapd repo and fixed issues with ubuntu-core- - initramfs deb builds - - Remove stale robust-mount-namespace-updates experimental feature - flag - - Remove snapd-snap experimental feature (rejected) and it's feature - flag - - Changed snap-bootstrap to mount base directly on /sysroot - - Mount ubuntu-seed mounted as no-{suid,exec,dev} - - Mapping volumes to disks: add support for volume-assignments in - gadget - - Fix silently broken binaries produced by distro patchelf 0.14.3 by - using locally build patchelf 0.18 - - Fix mismatch between listed refresh candidates and actual refresh - due to outdated validation sets - - Fix 'snap get' to produce compact listing for tty - - Fix missing store-url by keeping it as part of auxiliary store - info - - Fix snap-confine attempting to retrieve device cgroup setup inside - container where it is not available - - Fix 'snap set' and 'snap get' panic on empty strings with early - error checking - - Fix logger debug entries to show correct caller and file - information - - Fix issue preventing hybrid systems from being seeded on first - boot - - LP: #1966203 remove auto-import udev rules not required by deb - package to avoid unwanted syslog errors - - LP: #1886414 fix progress reporting when stdout is on a tty, but - stdin is not - -* Wed Jan 22 2025 Zygmunt Krynicki -- The changelog date and author have been modified to maintain linearity. -- Drop 0001-data-selinux-remove-timedatex.patch - applied upstream. -- New upstream release 2.67 - - AppArmor prompting (experimental): allow overlapping rules - - Registry view (experimental): Changes to registry data (from both - users and snaps) can be validated and saved by custodian snaps - - Registry view (experimental): Support 'snapctl get --pristine' to - read the registry data excluding staged transaction changes - - Registry view (experimental): Put registry commands behind - experimental feature flag - - Components: Make modules shipped/created by kernel-modules - components available right after reboot - - Components: Add tab completion for local component files - - Components: Allow installing snaps and components from local files - jointly on the CLI - - Components: Allow 'snapctl model' command for gadget and kernel - snaps - - Components: Add 'snap components' command - - Components: Bug fixes - - eMMC gadget updates (WIP): add syntax support in gadget.yaml for - eMMC schema - - Support for ephemeral recovery mode on hybrid systems - - Support for dm-verity options in snap-bootstrap - - Support for overlayfs options and allow empty what argument for - tmpfs - - Enable ubuntu-image to determine the size of the disk image to - create - - Expose 'snap debug' commands 'validate-seed' and 'seeding' - - Add debug API option to use dedicated snap socket /run/snapd- - snap.socket - - Hide experimental features that are no longer required - (accepted/rejected) - - Mount ubuntu-save partition with no{exec,dev,suid} at install, run - and factory-reset - - Improve memory controller support with cgroup v2 - - Support ssh socket activation configurations (used by ubuntu - 22.10+) - - Fix generation of AppArmor profile with incorrect revision during - multi snap refresh - - Fix refresh app awareness related deadlock edge case - - Fix not caching delta updated snap download - - Fix passing non root uid, guid to initial tmpfs mount - - Fix ignoring snaps in try mode when amending - - Fix reloading of service activation units to avoid systemd errors - - Fix snapd snap FIPS build on Launchpad to use Advantage Pro FIPS - updates PPA - - Make killing of snap apps best effort to avoid possibility of - malicious failure loop - - Alleviate impact of auto-refresh failure loop with progressive - delay - - Dropped timedatex in selinux-policy to avoid runtime issue - - Fix missing syscalls in seccomp profile - - Modify AppArmor template to allow using SNAP_REEXEC on arch - systems - - Modify AppArmor template to allow using vim.tiny (available in - base snaps) - - Modify AppArmor template to add read-access to debian_version - - Modify AppArmor template to allow owner to read - @{PROC}/@{pid}/sessionid - - {common,personal,system}-files interface: prohibit trailing @ in - filepaths - - {desktop,shutdown,system-observe,upower-observe} interface: - improve for Ubuntu Core Desktop - - custom-device interface: allow @ in custom-device filepaths - - desktop interface: improve launch entry and systray integration - with session - - desktop-legacy interface: allow DBus access to - com.canonical.dbusmenu - - fwupd interface: allow access to nvmem for thunderbolt plugin - - mpris interface: add plasmashell as label - - mount-control interface: add support for nfs mounts - - network-{control,manager} interface: add missing dbus link rules - - network-manager-observe interface: add getDevices methods - - opengl interface: add Kernel Fusion Driver access to opengl - - screen-inhibit-control interface: improve screen inhibit control - for use on core - - udisks2 interface: allow ping of the UDisks2 service - - u2f-devices interface: add Nitrokey Passkey - -* Sun Jan 19 2025 Fedora Release Engineering - 2.66.1-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild - -* Wed Jan 15 2025 Ernest Lotter -- New upstream release 2.67.1 - - Fix apparmor permissions to allow snaps access to kernel modules - and firmware on UC24, which also fixes the kernel-modules-control - interface on UC24 - - AppArmor prompting (experimental): disallow /./ and /../ in path - patterns - - Fix 'snap run' getent based user lookup in case of bad PATH - - Fix snapd using the incorrect AppArmor version during undo of an - refresh for regenerating snap profiles - - Add new syscalls to base templates - - hardware-observe interface: allow riscv_hwprobe syscall - - mount-observe interface: allow listmount and statmount syscalls - -* Tue Dec 03 2024 Orion Poplawski -- Drop RestartMode from snapd.service on EL8 (rhbz#2315759) - -* Fri Nov 29 2024 Zygmunt Krynicki -- Re-cherry pick fix for SELinux timedatex problem from upstream - as it was not released in 2.66.1, sorry. - -* Wed Nov 20 2024 Zygmunt Krynicki -- Drop only patch, applied upstream. - -* Fri Oct 25 2024 Zygmunt Krynicki -- Cherry pick fix for SELinux timedatex problem from upstream - -* Fri Oct 11 2024 Ernest Lotter -- New upstream release 2.66.1 - - AppArmor prompting (experimental): Fix kernel prompting support - check - - Allow kernel snaps to have content slots - - Fix ignoring snaps in try mode when amending - -* Fri Oct 04 2024 Ernest Lotter -- New upstream release 2.66 - - AppArmor prompting (experimental): expand kernel support checks - - AppArmor prompting (experimental): consolidate error messages and - add error kinds - - AppArmor prompting (experimental): grant /v2/snaps/{name} via - snap-interfaces-requests-control - - AppArmor prompting (experimental): add checks for duplicate - pattern variants - - Registry views (experimental): add handlers that commit (and - cleanup) registry transactions - - Registry views (experimental): add a snapctl fail command for - rejecting registry transactions - - Registry views (experimental): allow custodian snaps to implement - registry hooks that modify and save registry data - - Registry views (experimental): run view-changed hooks only for - snaps plugging views affected by modified paths - - Registry views (experimental): make registry transactions - serialisable - - Snap components: handle refreshing components to revisions that - have been on the system before - - Snap components: enable creating Ubuntu Core images that contain - components - - Snap components: handle refreshing components independently of - snaps - - Snap components: handle removing components when refreshing a snap - that no longer defines them - - Snap components: extend snapd Ubuntu Core installation API to - allow for picking optional snaps and components to install - - Snap components: extend kernel.yaml with "dynamic-modules", - allowing kernel to define a location for kmods from component - hooks - - Snap components: renamed component type "test" to "standard" - - Desktop IDs: support installing desktop files with custom names - based on desktop-file-ids desktop interface plug attr - - Auto-install snapd on classic systems as prerequisite for any non- - essential snap install - - Support loading AppArmor profiles on WSL2 with non-default kernel - and securityfs mounted - - Debian/Fedora packaging updates - - Add snap debug command for investigating execution aspects of the - snap toolchain - - Improve snap pack error for easier parsing - - Add support for user services when refreshing snaps - - Add snap remove --terminate flag for terminating running snap - processes - - Support building FIPS complaint snapd deb and snap - - Fix to not use nss when looking up for users/groups from snapd - snap - - Fix ordering in which layout changes are saved - - Patch snapd snap dynamic linker to ignore LD_LIBRARY_PATH and - related variables - - Fix libexec dir for openSUSE Slowroll - - Fix handling of the shared snap directory for parallel installs - - Allow writing to /run/systemd/journal/dev-log by default - - Avoid state lock during snap removal to avoid delaying other snapd - operations - - Add nomad-support interface to enable running Hashicorp Nomad - - Add intel-qat interface - - u2f-devices interface: add u2f trustkey t120 product id and fx - series fido u2f devices - - desktop interface: improve integration with xdg-desktop-portal - - desktop interface: add desktop-file-ids plug attr to desktop - interface - - unity7 interface: support desktop-file-ids in desktop files rule - generation - - desktop-legacy interface: support desktop-file-ids in desktop - files rule generation - - desktop-legacy interface: grant access to gcin socket location - - login-session-observe interface: allow introspection - - custom-device interface: allow to explicitly identify matching - device in udev tagging block - - system-packages-doc interface: allow reading /usr/share/javascript - - modem-manager interface: add new format of WWAN ports - - pcscd interface: allow pcscd to read opensc.conf - - cpu-control interface: add IRQ affinity control to cpu_control - - opengl interface: add support for cuda workloads on Tegra iGPU in - opengl interface - -* Thu Sep 12 2024 Ernest Lotter -- New upstream release 2.65.3 - - Fix missing aux info from store on snap setup - -* Fri Sep 06 2024 Ernest Lotter -- New upstream release 2.65.2 - - Bump squashfuse from version 0.5.0 to 0.5.2 (used in snapd deb - only) - -* Sat Aug 24 2024 Ernest Lotter -- New upstream release 2.65.1 - - Support building snapd using base Core22 (Snapcraft 8.x) - - FIPS: support building FIPS complaint snapd variant that switches - to FIPS mode when the system boots with FIPS enabled - - AppArmor: update to latest 4.0.2 release - - AppArmor: enable using ABI 4.0 from host parser - - AppArmor: fix parser lookup - - AppArmor: support AppArmor snippet priorities - - AppArmor: allow reading cgroup memory.max file - - AppArmor: allow using snap-exec coming from the snapd snap when - starting a confined process with jailmode - - AppArmor prompting (experimental): add checks for prompting - support, include prompting status in system key, and restart snapd - if prompting flag changes - - AppArmor prompting (experimental): include prompt prefix in - AppArmor rules if prompting is supported and enabled - - AppArmor prompting (experimental): add common types, constraints, - and mappings from AppArmor permissions to abstract permissions - - AppArmor prompting (experimental): add path pattern parsing and - matching - - AppArmor prompting (experimental): add path pattern precedence - based on specificity - - AppArmor prompting (experimental): add packages to manage - outstanding request prompts and rules - - AppArmor prompting (experimental): add prompting API and notice - types, which require snap-interfaces-requests-control interface - - AppArmor prompting (experimental): feature flag can only be - enabled if prompting is supported, handler service connected, and - the service can be started - - Registry views (experimental): rename from aspects to registries - - Registry views (experimental): support reading registry views and - setting/unsetting registry data using snapctl - - Registry views (experimental): fetch and refresh registry - assertions as needed - - Registry views (experimental): restrict view paths from using a - number as first character and view names to storage path style - patterns - - Snap components: support installing snaps and components from - files at the same time (no REST API/CLI) - - Snap components: support downloading components related assertions - from the store - - Snap components: support installing components from the store - - Snap components: support removing components individually and - during snap removal - - Snap components: support kernel modules as components - - Snap components: support for component install, pre-refresh and - post-refresh hooks - - Snap components: initial support for building systems that contain - components - - Refresh app awareness (experimental): add data field for - /v2/changes REST API to allow associating each task with affected - snaps - - Refresh app awareness (experimental): use the app name from - .desktop file in notifications - - Refresh app awareness (experimental): give snap-refresh-observe - interface access to /v2/snaps/{name} endpoint - - Improve snap-confine compatibility with nvidia drivers - - Allow re-exec when SNAP_REEXEC is set for unlisted distros to - simplify testing - - Allow mixing revision and channel on snap install - - Generate GNU build ID for Go binaries - - Add missing etelpmoc.sh for shell completion - - Do not attempt to run snapd on classic when re-exec is disabled - - Packaging/build maintenance for Debian sid, Fedora, Arch, openSuse - - Add snap debug API command to enable running raw queries - - Enable snap-confine snap mount directory detection - - Replace global seccomp filter with deny rules in standard seccomp - template - - Remove support for Ubuntu Core Launcher (superseded by snap- - confine) - - Support creating pending serial bound users after serial assertion - becomes available - - Support disabling cloud-init using kernel command-line - - In hybrid systems, apps can refresh without waiting for restarts - required by essential snaps - - Ship snap-debug-info.sh script used for system diagnostics - - Improve error messages when attempting to run non-existent snap - - Switch to -u UID:GID for strace-static - - Support enabling snapd logging with snap set system - debug.snapd.{log,log-level} - - Add options system.coredump.enable and system.coredump.maxuse to - support using systemd-coredump on Ubuntu Core - - Provide documentation URL for 'snap interface ' - - Fix snapd riscv64 build - - Fix restarting activated services instead of their activator units - (i.e. sockets, timers) - - Fix potential unexpected auto-refresh of snap on managed schedule - - Fix potential segfault by guarding against kernel command-line - changes on classic system - - Fix proxy entries in /etc/environment with missing newline that - caused later manual entries to not be usable - - Fix offline remodelling by ignoring prerequisites that will - otherwise be downloaded from store - - Fix devmode seccomp deny regression that caused spamming the log - instead of actual denies - - Fix snap lock leak during refresh - - Fix not re-pinning validation sets that were already pinned when - enforcing new validation sets - - Fix handling of unexpected snapd runtime failure - - Fix /v2/notices REST API skipping notices with duplicate - timestamps - - Fix comparing systemd versions that may contain pre-release - suffixes - - Fix udev potentially starting before snap-device-helper is made - available - - Fix race in snap seed metadata loading - - Fix treating cloud-init exit status 2 as error - - Fix to prevent sending refresh complete notification if snap snap- - refresh-observe interface is connected - - Fix to queue snapctl service commands if run from the default- - configure hook to ensure they get up-to-date config values - - Fix stop service failure when the service is not actually running - anymore - - Fix parsing /proc/PID/mounts with spaces - - Add registry interface that provides snaps access to a particular - registry view - - Add snap-interfaces-requests-control interface to enable prompting - client snaps - - steam-support interface: remove all AppArmor and seccomp - restrictions to improve user experience - - opengl interface: improve compatibility with nvidia drivers - - home interface: autoconnect home on Ubuntu Core Desktop - - serial-port interface: support RPMsg tty - - display-control interface: allow changing LVDS backlight power and - brightness - - power-control interface: support for battery charging thesholds, - type/status and AC type/status - - cpu-control interface: allow CPU C-state control - - raw-usb interface: support RPi5 and Thinkpad x13s - - custom-device interface: allow device file locking - - lxd-support interface: allow LXD to self-manage its own cgroup - - network-manager interface: support MPTCP sockets - - network-control interface: allow plug/slot access to gnutls config - and systemd resolved cache flushing via D-Bus - - network-control interface: allow wpa_supplicant dbus api - - gpio-control interface: support gpiochip* devices - - polkit interface: fix "rw" mount option check - - u2f-devices interface: enable additional security keys - - desktop interface: enable kde theming support - -* Fri Aug 23 2024 Ernest Lotter -- New upstream release 2.65 - - Support building snapd using base Core22 (Snapcraft 8.x) - - FIPS: support building FIPS complaint snapd variant that switches - to FIPS mode when the system boots with FIPS enabled - - AppArmor: update to latest 4.0.2 release - - AppArmor: enable using ABI 4.0 from host parser - - AppArmor: fix parser lookup - - AppArmor: support AppArmor snippet priorities - - AppArmor: allow reading cgroup memory.max file - - AppArmor: allow using snap-exec coming from the snapd snap when - starting a confined process with jailmode - - AppArmor prompting (experimental): add checks for prompting - support, include prompting status in system key, and restart snapd - if prompting flag changes - - AppArmor prompting (experimental): include prompt prefix in - AppArmor rules if prompting is supported and enabled - - AppArmor prompting (experimental): add common types, constraints, - and mappings from AppArmor permissions to abstract permissions - - AppArmor prompting (experimental): add path pattern parsing and - matching - - AppArmor prompting (experimental): add path pattern precedence - based on specificity - - AppArmor prompting (experimental): add packages to manage - outstanding request prompts and rules - - AppArmor prompting (experimental): add prompting API and notice - types, which require snap-interfaces-requests-control interface - - AppArmor prompting (experimental): feature flag can only be - enabled if prompting is supported, handler service connected, and - the service can be started - - Registry views (experimental): rename from aspects to registries - - Registry views (experimental): support reading registry views and - setting/unsetting registry data using snapctl - - Registry views (experimental): fetch and refresh registry - assertions as needed - - Registry views (experimental): restrict view paths from using a - number as first character and view names to storage path style - patterns - - Snap components: support installing snaps and components from - files at the same time (no REST API/CLI) - - Snap components: support downloading components related assertions - from the store - - Snap components: support installing components from the store - - Snap components: support removing components individually and - during snap removal - - Snap components: support kernel modules as components - - Snap components: support for component install, pre-refresh and - post-refresh hooks - - Snap components: initial support for building systems that contain - components - - Refresh app awareness (experimental): add data field for - /v2/changes REST API to allow associating each task with affected - snaps - - Refresh app awareness (experimental): use the app name from - .desktop file in notifications - - Refresh app awareness (experimental): give snap-refresh-observe - interface access to /v2/snaps/{name} endpoint - - Improve snap-confine compatibility with nvidia drivers - - Allow re-exec when SNAP_REEXEC is set for unlisted distros to - simplify testing - - Allow mixing revision and channel on snap install - - Generate GNU build ID for Go binaries - - Add missing etelpmoc.sh for shell completion - - Do not attempt to run snapd on classic when re-exec is disabled - - Packaging/build maintenance for Debian sid, Fedora, Arch, openSuse - - Add snap debug API command to enable running raw queries - - Enable snap-confine snap mount directory detection - - Replace global seccomp filter with deny rules in standard seccomp - template - - Remove support for Ubuntu Core Launcher (superseded by snap- - confine) - - Support creating pending serial bound users after serial assertion - becomes available - - Support disabling cloud-init using kernel command-line - - In hybrid systems, apps can refresh without waiting for restarts - required by essential snaps - - Ship snap-debug-info.sh script used for system diagnostics - - Improve error messages when attempting to run non-existent snap - - Switch to -u UID:GID for strace-static - - Support enabling snapd logging with snap set system - debug.snapd.{log,log-level} - - Add options system.coredump.enable and system.coredump.maxuse to - support using systemd-coredump on Ubuntu Core - - Provide documentation URL for 'snap interface ' - - Fix restarting activated services instead of their activator units - (i.e. sockets, timers) - - Fix potential unexpected auto-refresh of snap on managed schedule - - Fix potential segfault by guarding against kernel command-line - changes on classic system - - Fix proxy entries in /etc/environment with missing newline that - caused later manual entries to not be usable - - Fix offline remodelling by ignoring prerequisites that will - otherwise be downloaded from store - - Fix devmode seccomp deny regression that caused spamming the log - instead of actual denies - - Fix snap lock leak during refresh - - Fix not re-pinning validation sets that were already pinned when - enforcing new validation sets - - Fix handling of unexpected snapd runtime failure - - Fix /v2/notices REST API skipping notices with duplicate - timestamps - - Fix comparing systemd versions that may contain pre-release - suffixes - - Fix udev potentially starting before snap-device-helper is made - available - - Fix race in snap seed metadata loading - - Fix treating cloud-init exit status 2 as error - - Fix to prevent sending refresh complete notification if snap snap- - refresh-observe interface is connected - - Fix to queue snapctl service commands if run from the default- - configure hook to ensure they get up-to-date config values - - Fix stop service failure when the service is not actually running - anymore - - Fix parsing /proc/PID/mounts with spaces - - Add registry interface that provides snaps access to a particular - registry view - - Add snap-interfaces-requests-control interface to enable prompting - client snaps - - steam-support interface: remove all AppArmor and seccomp - restrictions to improve user experience - - opengl interface: improve compatibility with nvidia drivers - - home interface: autoconnect home on Ubuntu Core Desktop - - serial-port interface: support RPMsg tty - - display-control interface: allow changing LVDS backlight power and - brightness - - power-control interface: support for battery charging thesholds, - type/status and AC type/status - - cpu-control interface: allow CPU C-state control - - raw-usb interface: support RPi5 and Thinkpad x13s - - custom-device interface: allow device file locking - - lxd-support interface: allow LXD to self-manage its own cgroup - - network-manager interface: support MPTCP sockets - - network-control interface: allow plug/slot access to gnutls config - and systemd resolved cache flushing via D-Bus - - network-control interface: allow wpa_supplicant dbus api - - gpio-control interface: support gpiochip* devices - - polkit interface: fix "rw" mount option check - - u2f-devices interface: enable additional security keys - - desktop interface: enable kde theming support - -* Mon Jul 29 2024 Miroslav Suchý - 2.63-3 -- convert license to SPDX - -* Fri Jul 26 2024 Miroslav Suchý - 2.63-2 -- convert license to SPDX - -* Wed Jul 24 2024 Ernest Lotter -- New upstream release 2.64 - - Support building snapd using base Core22 (Snapcraft 8.x) - - FIPS: support building FIPS complaint snapd variant that switches - to FIPS mode when the system boots with FIPS enabled - - AppArmor: update to AppArmor 4.0.1 - - AppArmor: support AppArmor snippet priorities - - AppArmor prompting: add checks for prompting support, include - prompting status in system key, and restart snapd if prompting - flag changes - - AppArmor prompting: include prompt prefix in AppArmor rules if - prompting is supported and enabled - - AppArmor prompting: add common types, constraints, and mappings - from AppArmor permissions to abstract permissions - - AppArmor prompting: add path pattern parsing and matching - - Registry views (experimental): rename from aspects to registries - - Registry views (experimental): support reading registry views - using snapctl - - Registry views (experimental): restrict view paths from using a - number as first character and view names to storage path style - patterns - - Snap components: support installing snaps and components from - files at the same time (no REST API/CLI) - - Snap components: support downloading components related assertions - from the store - - Snap components: support installing components from the store (no - REST API/CLI) - - Snap components: support removing components (REST API, no CLI) - - Snap components: started support for component hooks - - Snap components: support kernel modules as components - - Refresh app awareness (experimental): add data field for - /v2/changes REST API to allow associating each task with affected - snaps - - Refresh app awareness (experimental): use the app name from - .desktop file in notifications - - Refresh app awareness (experimental): give snap-refresh-observe - interface access to /v2/snaps/{name} endpoint - - Allow re-exec when SNAP_REEXEC is set for unlisted distros to - simplify testing - - Generate GNU build ID for Go binaries - - Add missing etelpmoc.sh for shell completion - - Do not attempt to run snapd on classic when re-exec is disabled - - Packaging/build maintenance for Debian sid, Fedora, Arch, openSuse - - Add snap debug api command to enable running raw queries - - Enable snap-confine snap mount directory detection - - Replace global seccomp filter with deny rules in standard seccomp - template - - Remove support for Ubuntu Core Launcher (superseded by snap- - confine) - - Support creating pending serial bound users after serial assertion - becomes available - - Support disabling cloud-init using kernel command-line - - In hybrid systems, apps can refresh without waiting for restarts - required by essential snaps - - Ship snap-debug-info.sh script used for system diagnostics - - Improve error messages when attempting to run non-existent snap - - Switch to -u UID:GID for strace-static - - Support enabling snapd logging with snap set system - debug.snapd.{log,log-level} - - Fix restarting activated services instead of their activator units - (i.e. sockets, timers) - - Fix potential unexpected auto-refresh of snap on managed schedule - - Fix potential segfault by guarding against kernel command-line - changes on classic system - - Fix proxy entries in /etc/environment with missing newline that - caused later manual entries to not be usable - - Fix offline remodelling by ignoring prerequisites that will - otherwise be downloaded from store - - Fix devmode seccomp deny regression that caused spamming the log - instead of actual denies - - Fix snap lock leak during refresh - - Fix not re-pinning validation sets that were already pinned when - enforcing new validation sets - - Fix handling of unexpected snapd runtime failure - - Fix /v2/notices REST API skipping notices with duplicate - timestamps - - Fix comparing systemd versions that may contain pre-release - suffixes - - Fix udev potentially starting before snap-device-helper is made - available - - Fix race in snap seed metadata loading - - Fix treating cloud-init exit status 2 as error - - Fix to prevent sending refresh complete notification if snap snap- - refresh-observe interface is connected - - Fix to queue snapctl service commands if run from the default- - configure hook to ensure they get up-to-date config values - - Fix stop service failure when the service is not actually running - anymore - - Add registry interface that provides snaps access to a particular - registry view - - steam-support interface: relaxed AppArmor and seccomp restrictions - to improve user experience - - home interface: autoconnect home on Ubuntu Core Desktop - - serial-port interface: support RPMsg tty - - display-control interface: allow changing LVDS backlight power and - brightness - - power-control interface: support for battery charging thesholds, - type/status and AC type/status - - cpu-control interface: allow CPU C-state control - - raw-usb interface: support RPi5 and Thinkpad x13s - - custom-device interface: allow device file locking - - lxd-support interface: allow LXD to self-manage its own cgroup - - network-manager interface: support MPTCP sockets - - network-control interface: allow plug/slot access to gnutls config - and systemd resolved cache flushing via D-Bus - -* Sat Jul 20 2024 Fedora Release Engineering - 2.63-1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - -* Wed Apr 24 2024 Ernest Lotter -- New upstream release 2.63 - - Support for snap services to show the current status of user - services (experimental) - - Refresh app awareness: record snap-run-inhibit notice when - starting app from snap that is busy with refresh (experimental) - - Refresh app awareness: use warnings as fallback for desktop - notifications (experimental) - - Aspect based configuration: make request fields in the aspect- - bundle's rules optional (experimental) - - Aspect based configuration: make map keys conform to the same - format as path sub-keys (experimental) - - Aspect based configuration: make unset and set behaviour similar - to configuration options (experimental) - - Aspect based configuration: limit nesting level for setting value - (experimental) - - Components: use symlinks to point active snap component revisions - - Components: add model assertion support for components - - Components: fix to ensure local component installation always gets - a new revision number - - Add basic support for a CIFS remote filesystem-based home - directory - - Add support for AppArmor profile kill mode to avoid snap-confine - error - - Allow more than one interface to grant access to the same API - endpoint or notice type - - Allow all snapd service's control group processes to send systemd - notifications to prevent warnings flooding the log - - Enable not preseeded single boot install - - Update secboot to handle new sbatlevel - - Fix to not use cgroup for non-strict confined snaps (devmode, - classic) - - Fix two race conditions relating to freedesktop notifications - - Fix missing tunables in snap-update-ns AppArmor template - - Fix rejection of snapd snap udev command line by older host snap- - device-helper - - Rework seccomp allow/deny list - - Clean up files removed by gadgets - - Remove non-viable boot chains to avoid secboot failure - - posix_mq interface: add support for missing time64 mqueue syscalls - mq_timedreceive_time64 and mq_timedsend_time64 - - password-manager-service interface: allow kwalletd version 6 - - kubernetes-support interface: allow SOCK_SEQPACKET sockets - - system-observe interface: allow listing systemd units and their - properties - - opengl interface: enable use of nvidia container toolkit CDI - config generation - -* Thu Mar 21 2024 Ernest Lotter -- New upstream release 2.62 - - Aspects based configuration schema support (experimental) - - Refresh app awareness support for UI (experimental) - - Support for user daemons by introducing new control switches - --user/--system/--users for service start/stop/restart - (experimental) - - Add AppArmor prompting experimental flag (feature currently - unsupported) - - Installation of local snap components of type test - - Packaging of components with snap pack - - Expose experimental features supported/enabled in snapd REST API - endpoint /v2/system-info - - Support creating and removing recovery systems for use by factory - reset - - Enable API route for creating and removing recovery systems using - /v2/systems with action create and /v2/systems/{label} with action - remove - - Lift requirements for fde-setup hook for single boot install - - Enable single reboot gadget update for UC20+ - - Allow core to be removed on classic systems - - Support for remodeling on hybrid systems - - Install desktop files on Ubuntu Core and update after snapd - upgrade - - Upgrade sandbox features to account for cgroup v2 device filtering - - Support snaps to manage their own cgroups - - Add support for AppArmor 4.0 unconfined profile mode - - Add AppArmor based read access to /etc/default/keyboard - - Upgrade to squashfuse 0.5.0 - - Support useradd utility to enable removing Perl dependency for - UC24+ - - Support for recovery-chooser to use console-conf snap - - Add support for --uid/--gid using strace-static - - Add support for notices (from pebble) and expose via the snapd - REST API endpoints /v2/notices and /v2/notice - - Add polkit authentication for snapd REST API endpoints - /v2/snaps/{snap}/conf and /v2/apps - - Add refresh-inhibit field to snapd REST API endpoint /v2/snaps - - Add refresh-inhibited select query to REST API endpoint /v2/snaps - - Take into account validation sets during remodeling - - Improve offline remodeling to use installed revisions of snaps to - fulfill the remodel revision requirement - - Add rpi configuration option sdtv_mode - - When snapd snap is not installed, pin policy ABI to 4.0 or 3.0 if - present on host - - Fix gadget zero-sized disk mapping caused by not ignoring zero - sized storage traits - - Fix gadget install case where size of existing partition was not - correctly taken into account - - Fix trying to unmount early kernel mount if it does not exist - - Fix restarting mount units on snapd start - - Fix call to udev in preseed mode - - Fix to ensure always setting up the device cgroup for base bare - and core24+ - - Fix not copying data from newly set homedirs on revision change - - Fix leaving behind empty snap home directories after snap is - removed (resulting in broken symlink) - - Fix to avoid using libzstd from host by adding to snapd snap - - Fix autorefresh to correctly handle forever refresh hold - - Fix username regex allowed for system-user assertion to not allow - '+' - - Fix incorrect application icon for notification after autorefresh - completion - - Fix to restart mount units when changed - - Fix to support AppArmor running under incus - - Fix case of snap-update-ns dropping synthetic mounts due to - failure to match desired mount dependencies - - Fix parsing of base snap version to enable pre-seeding of Ubuntu - Core Desktop - - Fix packaging and tests for various distributions - - Add remoteproc interface to allow developers to interact with - Remote Processor Framework which enables snaps to load firmware to - ARM Cortex microcontrollers - - Add kernel-control interface to enable controlling the kernel - firmware search path - - Add nfs-mount interface to allow mounting of NFS shares - - Add ros-opt-data interface to allow snaps to access the host - /opt/ros/ paths - - Add snap-refresh-observe interface that provides refresh-app- - awareness clients access to relevant snapd API endpoints - - steam-support interface: generalize Pressure Vessel root paths and - allow access to driver information, features and container - versions - - steam-support interface: make implicit on Ubuntu Core Desktop - - desktop interface: improved support for Ubuntu Core Desktop and - limit autoconnection to implicit slots - - cups-control interface: make autoconnect depend on presence of - cupsd on host to ensure it works on classic systems - - opengl interface: allow read access to /usr/share/nvidia - - personal-files interface: extend to support automatic creation of - missing parent directories in write paths - - network-control interface: allow creating /run/resolveconf - - network-setup-control and network-setup-observe interfaces: allow - busctl bind as required for systemd 254+ - - libvirt interface: allow r/w access to /run/libvirt/libvirt-sock- - ro and read access to /var/lib/libvirt/dnsmasq/** - - fwupd interface: allow access to IMPI devices (including locking - of device nodes), sysfs attributes needed by amdgpu and the COD - capsule update directory - - uio interface: allow configuring UIO drivers from userspace - libraries - - serial-port interface: add support for NXP Layerscape SoC - - lxd-support interface: add attribute enable-unconfined-mode to - require LXD to opt-in to run unconfined - - block-devices interface: add support for ZFS volumes - - system-packages-doc interface: add support for reading jquery and - sphinx documentation - - system-packages-doc interface: workaround to prevent autoconnect - failure for snaps using base bare - - microceph-support interface: allow more types of block devices to - be added as an OSD - - mount-observe interface: allow read access to - /proc/{pid}/task/{tid}/mounts and proc/{pid}/task/{tid}/mountinfo - - polkit interface: changed to not be implicit on core because - installing policy files is not possible - - upower-observe interface: allow stats refresh - - gpg-public-keys interface: allow creating lock file for certain - gpg operations - - shutdown interface: allow access to SetRebootParameter method - - media-control interface: allow device file locking - - u2f-devices interface: support for Trustkey G310H, JaCarta U2F, - Kensington VeriMark Guard, RSA DS100, Google Titan v2 - -* Wed Mar 06 2024 Ernest Lotter -- New upstream release 2.61.3 - - Install systemd files in correct location for 24.04 - -* Fri Feb 16 2024 Ernest Lotter -- New upstream release 2.61.2 - - Fix to enable plug/slot sanitization for prepare-image - - Fix panic when device-service.access=offline - - Support offline remodeling - - Allow offline update only remodels without serial - - Fail early when remodeling to old model revision - - Fix to enable plug/slot sanitization for validate-seed - - Allow removal of core snap on classic systems - - Fix network-control interface denial for file lock on /run/netns - - Add well-known core24 snap-id - - Fix remodel snap installation order - - Prevent remodeling from UC18+ to UC16 - - Fix cups auto-connect on classic with cups snap installed - - u2f-devices interface support for GoTrust Idem Key with USB-C - - Fix to restore services after unlink failure - - Add libcudnn.so to Nvidia libraries - - Fix skipping base snap download due to false snapd downgrade - conflict - -* Sun Feb 11 2024 Maxwell G - 2.61.1-2 -- Rebuild for golang 1.22.0 - -* Sat Jan 27 2024 Fedora Release Engineering - 2.61.1-1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - -* Thu Jan 18 2024 Zygmunt Krynicki - 2.61.1-1 -- Changelog resynchronization - -* Wed Jan 17 2024 Zygmunt Krynicki - 2.58.3-3 -- Require xdelta on Fedora or EPEL >= 9 (for delta updates) - -* Fri Nov 24 2023 Ernest Lotter -- New upstream release 2.61.1 - - Stop requiring default provider snaps on image building and first - boot if alternative providers are included and available - - Fix auth.json access for login as non-root group ID - - Fix incorrect remodelling conflict when changing track to older - snapd version - - Improved check-rerefresh message - - Fix UC16/18 kernel/gadget update failure due volume mismatch with - installed disk - - Stop auto-import of assertions during install modes - - Desktop interface exposes GetIdletime - - Polkit interface support for new polkit versions - - Fix not applying snapd snap changes in tracked channel when remodelling - -* Fri Oct 13 2023 Philip Meulengracht -- New upstream release 2.61 - - Fix control of activated services in 'snap start' and 'snap stop' - - Correctly reflect activated services in 'snap services' - - Disabled services are no longer enabled again when snap is - refreshed - - interfaces/builtin: added support for Token2 U2F keys - - interfaces/u2f-devices: add Swissbit iShield Key - - interfaces/builtin: update gpio apparmor to match pattern that - contains multiple subdirectories under /sys/devices/platform - - interfaces: add a polkit-agent interface - - interfaces: add pcscd interface - - Kernel command-line can now be edited in the gadget.yaml - - Only track validation-sets in run-mode, fixes validation-set - issues on first boot. - - Added support for using store.access to disable access to snap - store - - Support for fat16 partition in gadget - - Pre-seed authority delegation is now possible - - Support new system-user name daemon - - Several bug fixes and improvements around remodelling - - Offline remodelling support - -* Fri Sep 15 2023 Michael Vogt -- New upstream release 2.60.4 - - i/b/qualcomm_ipc_router.go: switch to plug/slot and add socket - permission - - interfaces/builtin: fix custom-device udev KERNEL values - - overlord: allow the firmware-updater snap to install user daemons - - interfaces: allow loopback as a block-device - -* Fri Aug 25 2023 Michael Vogt -- New upstream release 2.60.3 - - i/b/shared-memory: handle "private" plug attribute in shared- - memory interface correctly - - i/apparmor: support for home.d tunables from /etc/ - -* Fri Aug 04 2023 Michael Vogt -- New upstream release 2.60.2 - - i/builtin: allow directories in private /dev/shm - - i/builtin: add read access to /proc/task/schedstat in system- - observe - - snap-bootstrap: print version information at startup - - go.mod: update gopkg.in/yaml.v3 to v3.0.1 to fix CVE-2022-28948 - - snap, store: filter out invalid snap edited links from store info - and persisted state - - o/configcore: write netplan defaults to 00-snapd-config on seeding - - snapcraft.yaml: pull in apparmor_parser optimization patches from - https://gitlab.com/apparmor/apparmor/-/merge_requests/711 - - snap-confine: fix missing \0 after readlink - - cmd/snap: hide append-integrity-data - - interfaces/opengl: add support for ARM Mali - -* Sat Jul 22 2023 Fedora Release Engineering - 2.58.3-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - -* Tue Jul 04 2023 Michael Vogt -- New upstream release 2.60.1 - - install: fallback to lazy unmount() in writeFilesystemContent - - data: include "modprobe.d" and "modules-load.d" in preseeded blob - - gadget: fix install test on armhf - - interfaces: fix typo in network_manager_observe - - sandbox/apparmor: don't let vendored apparmor conflict with system - - gadget/update: set parts in laid out data from the ones matched - - many: move SnapConfineAppArmorDir from dirs to sandbox/apparmor - - many: stop using `-O no-expr-simplify` in apparmor_parser - - go.mod: update secboot to latest uc22 branch - -* Thu Jun 15 2023 Michael Vogt -- New upstream release 2.60 - - Support for dynamic snapshot data exclusions - - Apparmor userspace is vendored inside the snapd snap - - Added a default-configure hook that exposes gadget default - configuration options to snaps during first install before - services are started - - Allow install from initrd to speed up the initial installation - for systems that do not have a install-device hook - - New `snap sign --chain` flag that appends the account and - account-key assertions - - Support validation-sets in the model assertion - - Support new "min-size" field in gadget.yaml - - New interface: "userns" - -* Sat May 27 2023 Michael Vogt -- New upstream release 2.59.5 - - Explicitly disallow the use of ioctl + TIOCLINUX - This fixes CVE-2023-1523. - -* Fri May 12 2023 Michael Vogt -- New upstream release 2.59.4 - - Retry when looking for disk label on non-UEFI systems - (LP: #2018977) - - Fix remodel from UC20 to UC22 - -* Wed May 03 2023 Michael Vogt -- New upstream release 2.59.3 - - Fix quiet boot - - i/b/physical_memory_observe: allow reading virt-phys page mappings - - gadget: warn instead of returning error if overlapping with GPT - header - - overlord,wrappers: restart always enabled units - - go.mod: update github.com/snapcore/secboot to latest uc22 - - boot: make sure we update assets for the system-seed-null role - - many: ignore case for vfat partitions when validating - -* Tue Apr 18 2023 Michael Vogt -- New upstream release 2.59.2 - - Notify users when a user triggered auto refresh finished - -* Tue Mar 28 2023 Michael Vogt -- New upstream release 2.59.1 - - Add udev rules from steam-devices to steam-support interface - - Bugfixes for layout path checking, dm_crypt permissions, - mount-control interface parameter checking, kernel commandline - parsing, docker-support, refresh-app-awareness - -* Fri Mar 10 2023 Michael Vogt -- New upstream release 2.59 - - Support setting extra kernel command line parameters via snap - configuration and under a gadget allow-list - - Support for Full-Disk-Encryption using ICE - - Support for arbitrary home dir locations via snap configuration - - New nvidia-drivers-support interface - - Support for udisks2 snap - - Pre-download of snaps ready for refresh and automatic refresh of - the snap when all apps are closed - - New microovn interface - - Support uboot with `CONFIG_SYS_REDUNDAND_ENV=n` - - Make "snap-preseed --reset" re-exec when needed - - Update the fwupd interface to support fully confined fwupd - - The memory,cpu,thread quota options are no longer experimental - - Support debugging snap client requests via the - `SNAPD_CLIENT_DEBUG_HTTP` environment variable - - Support ssh listen-address via snap configuration - - Support for quotas on single services - - prepare-image now takes into account snapd versions going into - the image, including in the kernel initrd, to fetch supported - assertion formats - * Sat Feb 25 2023 Maciek Borzecki - 2.58.3-1 - Releate 2.58.3 to Fedora RHBZ#2173056 @@ -4056,18 +2495,13 @@ fi * Tue Feb 15 2022 Michael Vogt - New upstream release 2.54.3 - - SECURITY UPDATE: Local privilege escalation - - snap-confine: Add validations of the location of the snap-confine - binary within snapd. - - snap-confine: Fix race condition in snap-confine when preparing a - private mount namespace for a snap. - - CVE-2021-44730 - - CVE-2021-44731 - - SECURITY UPDATE: Data injection from malicious snaps - - interfaces: Add validations of snap content interface and layout - paths in snapd. - - CVE-2021-4120 - - LP: #1949368 + - bugfixes + +* Tue Jan 25 2022 Maciek Borzecki - 2.54.2-1 +- Release 2.54.2 to Fedora + +* Sat Jan 22 2022 Fedora Release Engineering - 2.54.1-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild * Thu Jan 06 2022 Ian Johnson - New upstream release 2.54.2 @@ -7495,7 +5929,7 @@ fi - New upstream release 2.45.1 - data/selinux: allow checking /var/cache/app-info - cmd/snap-confine: add support for libc6-lse - - interfaces: miscellaneous policy updates xlv + - interfaces: miscellanious policy updates xlv - snap-bootstrap: remove sealed key file on reinstall - interfaces-ssh-keys: Support reading /etc/ssh/ssh_config.d/ - gadget: make ext4 filesystems with or without metadata checksum diff --git a/sources b/sources index 5ba5479..6ef3eef 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (snapd_2.72.no-vendor.tar.xz) = fb556bdb60877a2536cd8e53a7e137935ba27afb5b04efff06d8f858c47cec82a8f1df01fb621f644f0c2abe056a2b0612fabd70ae2d909b2e960692763b8bff -SHA512 (snapd_2.72.only-vendor.tar.xz) = f80b5def82553c044027fbb208fc5d5f76633afe71a8210abc33b48b189fd9347fd1d04bc868c58dc5d0b7fe8c68f6e316edbb6d2a2e060f375a5cdc851c2278 +SHA512 (snapd_2.58.3.no-vendor.tar.xz) = c08a290d1c124947a760d883de0c69b78ee5d6fd751aa062ca5c8c4c3ce32adf3cd7cc6539dfea1c61e7766a82cb613570d2cdf3c660b269744ee43ed77b047f +SHA512 (snapd_2.58.3.only-vendor.tar.xz) = b9444711d0b057cd97e4ccb1e28f1c375db576369832fdc1a5f432004ddd5e9e252d454beeeae0f45913a187030f1274a1ba2d6f5730376e8818fba6da6a4599 diff --git a/tests/simple.sh b/tests/simple.sh index fe43306..ca49be8 100755 --- a/tests/simple.sh +++ b/tests/simple.sh @@ -4,8 +4,6 @@ set -ex # snapd should get activated snap list -# wait for snapd to be operational -snap wait system seed.loaded # install a snap snap install test-snapd-tools # run an app from that snap