From 5bca412307f77efd70633095712a188a8cd97e7a Mon Sep 17 00:00:00 2001 From: Maxwell G Date: Sun, 3 Jul 2022 23:27:54 -0500 Subject: [PATCH 01/44] Only build on %golang_arches (i.e. where golang is available). Currently, %golang_arches is the same as the architectures that are "verified upstream," but this may change in the future when/if we stop building golang for a certain architecture. --- snapd.spec | 17 ++++++----------- 1 file changed, 6 insertions(+), 11 deletions(-) diff --git a/snapd.spec b/snapd.spec index 7029a7b..796b0da 100644 --- a/snapd.spec +++ b/snapd.spec @@ -16,9 +16,6 @@ %global with_unit_test 0 %global with_test_keys 0 -# For the moment, we don't support all golang arches... -%global with_goarches 0 - # Set if multilib is enabled for supported arches %ifarch x86_64 aarch64 %{power64} s390x %global with_multilib 1 @@ -86,20 +83,14 @@ Name: snapd Version: 2.56.2 -Release: 2%{?dist} +Release: 3%{?dist} Summary: A transactional software package manager License: GPLv3 URL: https://%{provider_prefix} Source0: https://%{provider_prefix}/releases/download/%{version}/%{name}_%{version}.no-vendor.tar.xz Source1: https://%{provider_prefix}/releases/download/%{version}/%{name}_%{version}.only-vendor.tar.xz -%if 0%{?with_goarches} -# e.g. el6 has ppc64 arch without gcc-go, so EA tag is required -ExclusiveArch: %{?go_arches:%{go_arches}}%{!?go_arches:%{ix86} x86_64 %{arm}} -%else -# Verified arches from snapd upstream -ExclusiveArch: %{ix86} x86_64 %{arm} aarch64 ppc64le s390x -%endif +ExclusiveArch: %{?golang_arches}%{!?golang_arches:%{ix86} x86_64 %{arm} aarch64 ppc64le s390x} # If go_compiler is not set to 1, there is no virtual provide. Use golang instead. BuildRequires: make @@ -936,6 +927,10 @@ fi %changelog +* Mon Jul 04 2022 Maxwell G - 2.56.2-2 +- Only build on %%golang_arches (i.e. where golang is available). +- Rebuild to fix update ordering issues. + * Sat Jul 09 2022 Maxwell G - 2.56.2-2 - Rebuild for CVE-2022-{24675,28327,29526 in golang} From c1cc9272a5122bcbe126c5ed17460f3d38fa06d2 Mon Sep 17 00:00:00 2001 From: Maxwell G Date: Sun, 10 Jul 2022 21:03:47 -0500 Subject: [PATCH 02/44] Fix changelog --- snapd.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/snapd.spec b/snapd.spec index 796b0da..7492537 100644 --- a/snapd.spec +++ b/snapd.spec @@ -927,7 +927,7 @@ fi %changelog -* Mon Jul 04 2022 Maxwell G - 2.56.2-2 +* Sun Jul 10 2022 Maxwell G - 2.56.2-2 - Only build on %%golang_arches (i.e. where golang is available). - Rebuild to fix update ordering issues. From b73554580535e52b4570c183990ba634076dbb0a Mon Sep 17 00:00:00 2001 From: Maxwell G Date: Tue, 19 Jul 2022 13:59:07 -0500 Subject: [PATCH 03/44] Rebuild for CVE-2022-{1705,32148,30631,30633,28131,30635,30632,30630,1962} in golang --- snapd.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/snapd.spec b/snapd.spec index 7492537..a4bdbc0 100644 --- a/snapd.spec +++ b/snapd.spec @@ -83,7 +83,7 @@ Name: snapd Version: 2.56.2 -Release: 3%{?dist} +Release: 4%{?dist} Summary: A transactional software package manager License: GPLv3 URL: https://%{provider_prefix} @@ -927,6 +927,10 @@ fi %changelog +* Tue Jul 19 2022 Maxwell G - 2.56.2-4 +- Rebuild for CVE-2022-{1705,32148,30631,30633,28131,30635,30632,30630,1962} in + golang + * Sun Jul 10 2022 Maxwell G - 2.56.2-2 - Only build on %%golang_arches (i.e. where golang is available). - Rebuild to fix update ordering issues. From 5a33ee39b69f6b920b752cc19b9af390caf5f03f Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 23 Jul 2022 08:56:43 +0000 Subject: [PATCH 04/44] Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- snapd.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/snapd.spec b/snapd.spec index a4bdbc0..1af0360 100644 --- a/snapd.spec +++ b/snapd.spec @@ -83,7 +83,7 @@ Name: snapd Version: 2.56.2 -Release: 4%{?dist} +Release: 5%{?dist} Summary: A transactional software package manager License: GPLv3 URL: https://%{provider_prefix} @@ -927,6 +927,9 @@ fi %changelog +* Sat Jul 23 2022 Fedora Release Engineering - 2.56.2-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + * Tue Jul 19 2022 Maxwell G - 2.56.2-4 - Rebuild for CVE-2022-{1705,32148,30631,30633,28131,30635,30632,30630,1962} in golang From 7a069b5876737384f1064e63ec0e4c295c15c1c0 Mon Sep 17 00:00:00 2001 From: Maciek Borzecki Date: Sun, 27 Nov 2022 21:08:22 +0100 Subject: [PATCH 05/44] snapd: update to 2.57.5 Signed-off-by: Maciek Borzecki --- .gitignore | 2 + ...nfine-do-not-discard-const-qualifier.patch | 35 ++ snapd.spec | 347 +++++++++++++++++- sources | 4 +- 4 files changed, 380 insertions(+), 8 deletions(-) create mode 100644 0001-cmd-snap-confine-do-not-discard-const-qualifier.patch diff --git a/.gitignore b/.gitignore index cb1da1d..8c0625d 100644 --- a/.gitignore +++ b/.gitignore @@ -92,3 +92,5 @@ /snapd_2.55.3.only-vendor.tar.xz /snapd_2.56.2.no-vendor.tar.xz /snapd_2.56.2.only-vendor.tar.xz +/snapd_2.57.5.no-vendor.tar.xz +/snapd_2.57.5.only-vendor.tar.xz diff --git a/0001-cmd-snap-confine-do-not-discard-const-qualifier.patch b/0001-cmd-snap-confine-do-not-discard-const-qualifier.patch new file mode 100644 index 0000000..80f593f --- /dev/null +++ b/0001-cmd-snap-confine-do-not-discard-const-qualifier.patch @@ -0,0 +1,35 @@ +From 51c27ea0c71a1737607b21bf9de3cc91cf690ebd Mon Sep 17 00:00:00 2001 +Message-Id: <51c27ea0c71a1737607b21bf9de3cc91cf690ebd.1669579092.git.maciek.borzecki@gmail.com> +From: Maciej Borzecki +Date: Sun, 27 Nov 2022 20:47:29 +0100 +Subject: [PATCH] cmd/snap-confine: do not discard const qualifier + +GCC 12.2.1 with the default build flags in Rawhide is more picky than usual, and +fails with this: + +snap-confine/selinux-support.c:85:29: error: initialization discards 'const' qualifier from pointer target type [-Werror=discarded-qualifiers] + 85 | char *new_ctx_str = context_str(ctx); + | ^~~~~~~~~~~ +cc1: all warnings being treated as errors + +Signed-off-by: Maciej Borzecki +--- + cmd/snap-confine/selinux-support.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/cmd/snap-confine/selinux-support.c b/cmd/snap-confine/selinux-support.c +index 344a3444b23d10afa408d2f1390156b44506ebc8..a65c02632968ac0f8f23d1bd4b7045a5206b59d9 100644 +--- a/cmd/snap-confine/selinux-support.c ++++ b/cmd/snap-confine/selinux-support.c +@@ -82,7 +82,7 @@ int sc_selinux_set_snap_execcon(void) { + } + + /* freed by context_free(ctx) */ +- char *new_ctx_str = context_str(ctx); ++ const char *new_ctx_str = context_str(ctx); + if (new_ctx_str == NULL) { + die("cannot obtain updated SELinux context string"); + } +-- +2.38.1 + diff --git a/snapd.spec b/snapd.spec index 1af0360..a7a2869 100644 --- a/snapd.spec +++ b/snapd.spec @@ -65,8 +65,8 @@ %define gobuild_static(o:) go build -compiler gc -tags="rpm_crashtraceback ${BUILDTAGS:-}" -ldflags "-B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \\n') -linkmode external -extldflags '%__global_ldflags -static'" -a -v -x %{?**}; %endif -# These macros are missing BUILDTAGS in RHEL 8, see RHBZ#1825138 -%if 0%{?rhel} == 8 +# These macros are missing BUILDTAGS in RHEL 8/9, see RHBZ#1825138 +%if 0%{?rhel} >= 8 %define gobuild(o:) go build -buildmode pie -compiler gc -tags="rpm_crashtraceback ${BUILDTAGS:-}" -ldflags "-B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \\n') -linkmode external -extldflags '%__global_ldflags'" -a -v -x %{?**}; %endif @@ -82,13 +82,15 @@ %{!?_systemd_system_env_generator_dir: %global _systemd_system_env_generator_dir %{_prefix}/lib/systemd/system-environment-generators} Name: snapd -Version: 2.56.2 -Release: 5%{?dist} +Version: 2.57.5 +Release: 1%{?dist} Summary: A transactional software package manager License: GPLv3 URL: https://%{provider_prefix} Source0: https://%{provider_prefix}/releases/download/%{version}/%{name}_%{version}.no-vendor.tar.xz Source1: https://%{provider_prefix}/releases/download/%{version}/%{name}_%{version}.only-vendor.tar.xz +# FTBFS fix, submitted upstream https://github.com/snapcore/snapd/pull/12357 +Patch0: 0001-cmd-snap-confine-do-not-discard-const-qualifier.patch ExclusiveArch: %{?golang_arches}%{!?golang_arches:%{ix86} x86_64 %{arm} aarch64 ppc64le s390x} @@ -534,8 +536,8 @@ sed -e "s/-Bstatic -lseccomp/-Bstatic/g" -i cmd/snap-seccomp/*.go %if 0%{?rhel} == 7 M4PARAM='-D distro_rhel7' %endif -%if 0%{?rhel} == 7 || 0%{?rhel} == 8 - # RHEL7 and RHEL8 are missing the BPF interfaces from their reference policy +%if 0%{?rhel} == 7 || 0%{?rhel} == 8 || 0%{?rhel} == 9 + # RHEL7, RHEL8 and RHEL9 are missing the BPF interfaces from their reference policy M4PARAM="$M4PARAM -D no_bpf" %endif # Build SELinux module @@ -677,6 +679,11 @@ rm %{buildroot}%{_libexecdir}/snapd/system-shutdown rm -f %{buildroot}%{_unitdir}/snapd.apparmor.service rm -f %{buildroot}%{_libexecdir}/snapd/snapd-apparmor +# Remove prompt services +rm %{buildroot}%{_unitdir}/snapd.aa-prompt-listener.service +rm %{buildroot}%{_userunitdir}/snapd.aa-prompt-ui.service +rm %{buildroot}%{_datadir}/dbus-1/services/io.snapcraft.Prompt.service + # Install Polkit configuration install -m 644 -D data/polkit/io.snapcraft.snapd.policy %{buildroot}%{_datadir}/polkit-1/actions @@ -927,6 +934,314 @@ fi %changelog +* Sun Nov 27 2022 Maciek Borzecki - 2.57.5-1 +- Release 2.57.5 to Fedora + +* Mon Oct 17 2022 Michael Vogt +- New upstream release 2.57.5 + - image: clean snapd mount after preseeding + - wrappers,snap/quota: clear LogsDirectory= in the service unit + for journal namespaces + - cmd/snap,daemon: allow zero values from client to daemon for + journal rate-limit + - interfaces: steam-support allow pivot /run/media and /etc/nvidia + mount + - o/ifacestate: introduce DebugAutoConnectCheck hook + - release, snapd-apparmor, syscheck: distinguish WSL1 and WSL2 + - autopkgtests: fix running autopkgtest on kinetic + - interfaces: add microceph interface + - interfaces: steam-support allow additional mounts + - many: add stub services + - interfaces: add kconfig paths to system-observe + - i/b/system_observe: honour root dir when checking for + /boot/config-* + - interfaces: grant access to speech-dispatcher socket + - interfaces: rework logic of unclashMountEntries + +* Thu Sep 29 2022 Michael Vogt +- New upstream release 2.57.4 + - release, snapd-apparmor: fixed outdated WSL detection + - overlord/ifacestate: fix conflict detection of auto-connection + - overlord: run install-device hook during factory reset + - image/preseed/preseed_linux: add missing new line + - boot: add factory-reset cases for boot-flags. + - interfaces: added read/write access to /proc/self/coredump_filter + for process-control + - interfaces: add read access to /proc/cgroups and + /proc/sys/vm/swappiness to system-observe + - fde: run fde-reveal-key with `DefaultDependencies=no` + - snapdenv: added wsl to userAgent + - tests: fix restore section for persistent-journal-namespace + - i/b/mount-control: add optional `/` to umount rules + - cmd/snap-bootstrap: changes to be able to boot classic rootfs + - cmd/snap-bootstrap: add CVM mode + +* Thu Sep 15 2022 Michael Vogt +- New upstream release 2.57.3 + - wrappers: journal namespaces did not honor journal.persistent + - snap/quota,wrappers: allow using 0 values for the journal rate to + override the system default values + - multiple: clear up naming convention for cpu-set quota + - i/b/mount-control: allow custom filesystem types + - i/b/system-observe: allow reading processes security label + - sandbox/cgroup: don't check V1 cgroup if V2 is active + - asserts,boot,secboot: switch to a secboot version measuring + classic + +* Fri Sep 02 2022 Michael Vogt +- New upstream release 2.57.2 + - store/tooling,tests: support UBUNTU_STORE_URL override env var + - packaging/*/tests/integrationtests: reload ssh.service, not + sshd.service + - tests: check snap download with snapcraft v7+ export-login auth + data + - store/tooling: support using snapcraft v7+ base64-encoded auth + data + - many: progress bars should use the overridable stdouts + - many: refactor store code to be able to use simpler form of auth + creds + - snap,store: drop support/consideration for anonymous download urls + - data: include snapd/mounts in preseeded blob + - many: Set SNAPD_APPARMOR_REEXEC=1 + - overlord: track security profiles for non-active snaps + +* Wed Aug 10 2022 Alberto Mardegan +- New upstream release 2.57.1 + - cmd/snap-update-ns: handle mountpoint removal failures with EBUSY + - cmd/snap-update-ns: print current mount entries + - cmd/snap-update-ns: check the unused mounts with a cleaned path + - snap-confine: disable -Werror=array-bounds in __overflow tests to + fix build error on Ubuntu 22.10 + - systemd: add `WantedBy=default.target` to snap mount units + (LP: #1983528) + +* Thu Jul 28 2022 Michael Vogt +- New upstream release 2.57 + - tests: Fix calls to systemctl is-system-running + - osutil/disks: handle GPT for 4k disk and too small tables + - packaging: import change from the 2.54.3-1.1 upload + - many: revert "features: disable refresh-app-awarness by default + again" + - tests: improve robustness of preparation for regression/lp-1803542 + - tests: get the ubuntu-image binary built with test keys + - tests: remove commented code from lxd test + - interfaces/builtin: add more permissions for steam-support + - tests: skip interfaces-network-control on i386 + - tests: tweak the "tests/nested/manual/connections" test + - interfaces: posix-mq: allow specifying message queue paths as an + array + - bootloader/assets: add ttyS0,115200n8 to grub.cfg + - i/b/desktop,unity7: remove name= specification on D-Bus signals + - tests: ensure that microk8s does not produce DENIED messages + - many: support non-default provenance snap-revisions in + DeriveSideInfo + - tests: fix `core20-new-snapd-does-not-break-old-initrd` test + - many: device and provenance revision authority cross checks + - tests: fix nested save-data test on 22.04 + - sandbox/cgroup: ignore container slices when tracking snaps + - tests: improve 'ignore-running' spread test + - tests: add `debug:` section to `tests/nested/manual/connections` + - tests: remove leaking `pc-kernel.snap` in `repack_kernel_snap` + - many: preparations for revision authority cross checks including + device scope + - daemon,overlord/servicestate: followup changes from PR #11960 to + snap logs + - cmd/snap: fix visual representation of 'AxB%' cpu quota modifier. + - many: expose and support provenance from snap.yaml metadata + - overlord,snap: add support for per-snap storage on ubuntu-save + - nested: fix core-early-config nested test + - tests: revert lxd change to support nested lxd launch + - tests: add invariant check for leftover cgroup scopes + - daemon,systemd: introduce support for namespaces in 'snap logs' + - cmd/snap: do not track apps that wish to stay outside of the life- + cycle system + - asserts: allow classic + snaps models and add distribution to + model + - cmd/snap: add snap debug connections/connection commands + - data: start snapd after time-set.target + - tests: remove ubuntu 21.10 from spread tests due to end of life + - tests: Update the whitebox word to avoid inclusive naming issues + - many: mount gadget in run folder + - interfaces/hardware-observe: clean up reading access to sysfs + - tests: use overlayfs for interfaces-opengl-nvidia test + - tests: update fake-netplan-apply test for 22.04 + - tests: add executions for ubuntu 22.04 + - tests: enable centos-9 + - tests: make more robust the files check in preseed-core20 test + - bootloader/assets: add fallback entry to grub.cfg + - interfaces/apparmor: add permissions for per-snap directory on + ubuntu-save partition + - devicestate: add more path to `fixupWritableDefaultDirs()` + - boot,secboot: reset DA lockout counter after successful boot + - many: Revert "overlord,snap: add support for per-snap storage on + ubuntu-save" + - overlord,snap: add support for per-snap storage on ubuntu-save + - tests: exclude centos-7 from kernel-module-load test + - dirs: remove unused SnapAppArmorAdditionalDir + - boot,device: extract SealedKey helpers from boot to device + - boot,gadget: add new `device.TpmLockoutAuthUnder()` and use it + - interfaces/display-control: allow changing brightness value + - asserts: add more context to key expiry error + - many: introduce IsUndo flag in LinkContext + - i/apparmor: allow calling which.debianutils + - tests: new profile id for apparmor in test preseed-core20 + - tests: detect 403 in apt-hooks and skip test in this case + - overlord/servicestate: restart the relevant journald service when + a journal quota group is modified + - client,cmd/snap: add journal quota frontend (5/n) + - gadget/device: introduce package which provides helpers for + locations of things + - features: disable refresh-app-awarness by default again + - many: install bash completion files in writable directory + - image: fix handling of var/lib/extrausers when preseeding + uc20 + - tests: force version 2.48.3 on xenial ESM + - tests: fix snap-network-erros on uc16 + - cmd/snap-confine: be compatible with a snap rootfs built as a + tmpfs + - o/snapstate: allow install of unasserted gadget/kernel on + dangerous models + - interfaces: dynamic loading of kernel modules + - many: add optional primary key provenance to snap-revision, allow + delegating via snap-declaration revision-authority + - tests: fix boringcripto errors in centos7 + - tests: fix snap-validate-enforce in opensuse-tumbleweed + - test: print User-Agent on failed checks + - interfaces: add memory stats to system_observe + - interfaces/pwm: Remove implicitOnCore/implicitOnClassic + - spread: add openSUSE Leap 15.4 + - tests: disable core20-to-core22 nested test + - tests: fix nested/manual/connections test + - tests: add spread test for migrate-home command + - overlord/servicestate: refresh security profiles when services are + affected by quotas + - interfaces/apparmor: add missing apparmor rules for journal + namespaces + - tests: add nested test variant that adds 4k sector size + - cmd/snap: fix test failing due to timezone differences + - build-aux/snap: build against the snappy-dev/image PPA + - daemon: implement api handler for refresh with enforced validation + sets + - preseed: suggest to install "qemu-user-static" + - many: add migrate-home debug command + - o/snapstate: support passing validation sets to storehelpers via + RevisionOptions + - cmd/snapd-apparmor: fix unit tests on distros which do not support + reexec + - o/devicestate: post factory reset ensure, spread test update + - tests/core/basic20: Enable on uc22 + - packaging/arch: install snapd-apparmor + - o/snapstate: support migrating snap home as change + - tests: enable snapd.apparmor service in all the opensuse systems + - snapd-apparmor: add more integration-ish tests + - asserts: store required revisions for missing snaps in + CheckInstalledSnaps + - overlord/ifacestate: fix path for journal redirect + - o/devicestate: factory reset with encryption + - cmd/snapd-apparmor: reimplement snapd-apparmor in Go + - squashfs: improve error reporting when `unsquashfs` fails + - o/assertstate: support multiple extra validation sets in + EnforcedValidationSets + - tests: enable mount-order-regression test for arm devices + - tests: fix interfaces network control + - interfaces: update AppArmor template to allow read the memory … + - cmd/snap-update-ns: add /run/systemd to unrestricted paths + - wrappers: fix LogNamespace being written to the wrong file + - boot: release the new PCR handles when sealing for factory reset + - tests: add support fof uc22 in test uboot-unpacked-assets + - boot: post factory reset cleanup + - tests: add support for uc22 in listing test + - spread.yaml: add ubuntu-22.04-06 to qemu-nested + - gadget: check also mbr type when testing for implicit data + partition + - interfaces/system-packages-doc: allow read-only access to + /usr/share/cups/doc-root/ and /usr/share/gimp/2.0/help/ + - tests/nested/manual/core20-early-config: revert changes that + disable netplan checks + - o/ifacestate: warn if the snapd.apparmor service is disabled + - tests: add spread execution for fedora 36 + - overlord/hookstate/ctlcmd: fix timestamp coming out of sync in + unit tests + - gadget/install: do not assume dm device has same block size as + disk + - interfaces: update network-control interface with permissions + required by resolvectl + - secboot: stage and transition encryption keys + - secboot, boot: support and use alternative PCR handles during + factory reset + - overlord/ifacestate: add journal bind-mount snap layout when snap + is in a journal quota group (4/n) + - secboot/keymgr, cmd/snap-fde-keymgr: two step encryption key + change + - cmd/snap: cleanup and make the code a bit easier to read/maintain + for quota options + - overlord/hookstate/ctlcmd: add 'snapctl model' command (3/3) + - cmd/snap-repair: fix snap-repair tests silently failing + - spread: drop openSUSE Leap 15.2 + - interfaces/builtin: remove the name=org.freedesktop.DBus + restriction in cups-control AppArmor rules + - wrappers: write journald config files for quota groups with + journal quotas (3/n) + - o/assertstate: auto aliases for apps that exist + - o/state: use more detailed NoStateError in state + - tests/main/interfaces-browser-support: verify jupyter notebooks + access + - o/snapstate: exclude services from refresh app awareness hard + running check + - tests/main/nfs-support: be robust against umount failures + - tests: update centos images and add new centos 9 image + - many: print valid/invalid status on snap validate --monitor + - secboot, boot: TPM provisioning mode enum, introduce + reprovisioning + - tests: allow to re-execute aborted tests + - cmd/snapd-apparmor: add explicit WSL detection to + is_container_with_internal_policy + - tests: avoid launching lxd inside lxd on cloud images + - interfaces: extra htop apparmor rules + - gadget/install: encrypted system factory reset support + - secboot: helpers for dealing with PCR handles and TPM resources + - systemd: improve error handling for systemd-sysctl command + - boot, secboot: separate the TPM provisioning and key sealing + - o/snapstate: fix validation sets restoring and snap revert on + failed refresh + - interfaces/builtin/system-observe: extend access for htop + - cmd/snap: support custom apparmor features dir with snap prepare- + image + - interfaces/mount-observe: Allow read access to /run/mount/utab + - cmd/snap: add help strings for set-quota options + - interfaces/builtin: add README file + - cmd/snap-confine: mount support cleanups + - overlord: execute snapshot cleanup in task + - i/b/accounts_service: fix path of introspectable objects + - interfaces/opengl: update allowed PCI accesses for RPi + - configcore: add core.system.ctrl-alt-del-action config option + - many: structured startup timings + - spread: switch back to building ubuntu-image from source + - many: optional recovery keys + - tests/lib/nested: fix unbound variable + - run-checks: fail on equality checks w/ ErrNoState + - snap-bootstrap: Mount as private + - tests: Test for gadget connections + - tests: set `br54.dhcp4=false` in the netplan-cfg test + - tests: core20 preseed/nested spread test + - systemd: remove the systemctl stop timeout handling + - interfaces/shared-memory: Update AppArmor permissions for + mmap+link + - many: replace ErrNoState equality checks w/ errors.Is() + - cmd/snap: exit w/ non-zero code on missing snap + - systemd: fix snapd systemd-unit stop progress notifications + - .github: Trigger daily riscv64 snapd edge builds + - interfaces/serial-port: add ttyGS to serial port allow list + - interfaces/modem-manager: Don't generate DBus plug policy + - tests: add spread test to test upgrade from release snapd to + current + - wrappers: refactor EnsureSnapServices + - testutil: add ErrorIs test checker + - tests: import spread shellcheck changes + - cmd/snap-fde-keymgr: best effort idempotency of add-recovery-key + - interfaces/udev: refactor handling of udevadm triggers for input + - secboot: support for changing encryption keys via keymgr + * Sat Jul 23 2022 Fedora Release Engineering - 2.56.2-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild @@ -934,6 +1249,26 @@ fi - Rebuild for CVE-2022-{1705,32148,30631,30633,28131,30635,30632,30630,1962} in golang +* Wed Jul 13 2022 Michael Vogt +- New upstream release 2.56.3 + - devicestate: add more path to `fixupWritableDefaultDirs()` + - many: introduce IsUndo flag in LinkContext + - i/apparmor: allow calling which.debianutils + - interfaces: update AppArmor template to allow reading snap's + memory statistics + - interfaces: add memory stats to system_observe + - i/b/{mount,system}-observe: extend access for htop + - features: disable refresh-app-awarness by default again + - image: fix handling of var/lib/extrausers when preseeding + uc20 + - interfaces/modem-manager: Don't generate DBus policy for plugs + - interfaces/modem-manager: Only generate DBus plug policy on + Core + - interfaces/serial_port_test: fix static-checks errors + - interfaces/serial-port: add USB gadget serial devices (ttyGSX) to + allowed list + - interface/serial_port_test: adjust variable IDs + * Sun Jul 10 2022 Maxwell G - 2.56.2-2 - Only build on %%golang_arches (i.e. where golang is available). - Rebuild to fix update ordering issues. diff --git a/sources b/sources index ea1d20b..323c452 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (snapd_2.56.2.no-vendor.tar.xz) = 457396fad451a7e7c2940acc6268a55b17d28f30c7ca122030b2e516c15519cf5199163da814749615634484dd04125b85c3891cde8ffdac77dd592a24ea6b48 -SHA512 (snapd_2.56.2.only-vendor.tar.xz) = 5f4315c172815086a07bef919811d02c4ba882f1fe813f032bc4013fba25690a3bd2aa17937767b44dcc20a6d9e0420f7c73ba80540db82a991a19d4a464be69 +SHA512 (snapd_2.57.5.no-vendor.tar.xz) = 49666b7ba4589bbcaa557a88f3a4f4ea0b04cb7400b5b065aaa26d20ed0fae8f05ba93ca4861a6dd70178508781cd9dff1fb64f7d5393092b4212d4c47948d7c +SHA512 (snapd_2.57.5.only-vendor.tar.xz) = 79c033db93f3b478e0b6dd74b3a4b34a2e07d8ede64a05c84f9a64b0a193cf44c1d1bb04f5152ab9111e04e99ae2bf232442f1bcd694de4bb5f84e76a17a1882 From 2665dd675dd41799911813d9dcf16da0a2bd458b Mon Sep 17 00:00:00 2001 From: Maciek Borzecki Date: Tue, 29 Nov 2022 18:36:22 +0100 Subject: [PATCH 06/44] snapd: update to 2.57.6 Update to the latest security release. Signed-off-by: Maciek Borzecki --- .gitignore | 2 ++ snapd.spec | 12 +++++++++--- sources | 4 ++-- 3 files changed, 13 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index 8c0625d..35b4bb8 100644 --- a/.gitignore +++ b/.gitignore @@ -94,3 +94,5 @@ /snapd_2.56.2.only-vendor.tar.xz /snapd_2.57.5.no-vendor.tar.xz /snapd_2.57.5.only-vendor.tar.xz +/snapd_2.57.6.no-vendor.tar.xz +/snapd_2.57.6.only-vendor.tar.xz diff --git a/snapd.spec b/snapd.spec index a7a2869..d917576 100644 --- a/snapd.spec +++ b/snapd.spec @@ -82,7 +82,7 @@ %{!?_systemd_system_env_generator_dir: %global _systemd_system_env_generator_dir %{_prefix}/lib/systemd/system-environment-generators} Name: snapd -Version: 2.57.5 +Version: 2.57.6 Release: 1%{?dist} Summary: A transactional software package manager License: GPLv3 @@ -652,6 +652,7 @@ popd pushd ./data %make_install BINDIR="%{_bindir}" LIBEXECDIR="%{_libexecdir}" DATADIR="%{_datadir}" \ SYSTEMDSYSTEMUNITDIR="%{_unitdir}" SYSTEMDUSERUNITDIR="%{_userunitdir}" \ + TMPFILESDIR="%{_tmpfilesdir}" \ SNAP_MOUNT_DIR="%{_sharedstatedir}/snapd/snap" \ SNAPD_ENVIRONMENT_FILE="%{_sysconfdir}/sysconfig/snapd" popd @@ -785,6 +786,7 @@ popd %{_unitdir}/snapd.seeded.service %{_userunitdir}/snapd.session-agent.service %{_userunitdir}/snapd.session-agent.socket +%{_tmpfilesdir}/snapd.conf %{_datadir}/dbus-1/services/io.snapcraft.Launcher.service %{_datadir}/dbus-1/services/io.snapcraft.SessionAgent.service %{_datadir}/dbus-1/services/io.snapcraft.Settings.service @@ -934,8 +936,12 @@ fi %changelog -* Sun Nov 27 2022 Maciek Borzecki - 2.57.5-1 -- Release 2.57.5 to Fedora +* Wed Nov 30 2022 Maciek Borzecki +- Release 2.57.6 to Fedora + +* Tue Nov 15 2022 Michael Vogt +- New upstream release 2.57.6 + - bugfixes * Mon Oct 17 2022 Michael Vogt - New upstream release 2.57.5 diff --git a/sources b/sources index 323c452..5dca193 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (snapd_2.57.5.no-vendor.tar.xz) = 49666b7ba4589bbcaa557a88f3a4f4ea0b04cb7400b5b065aaa26d20ed0fae8f05ba93ca4861a6dd70178508781cd9dff1fb64f7d5393092b4212d4c47948d7c -SHA512 (snapd_2.57.5.only-vendor.tar.xz) = 79c033db93f3b478e0b6dd74b3a4b34a2e07d8ede64a05c84f9a64b0a193cf44c1d1bb04f5152ab9111e04e99ae2bf232442f1bcd694de4bb5f84e76a17a1882 +SHA512 (snapd_2.57.6.no-vendor.tar.xz) = 793c5efae35c9a6ae4fd992b115bef3b7ef40ba02eebd37b57ed1183db15a1acbeae4e6dcef8d7ed5e65d8cb246ff16dbd05ac7917463a2a8e60fc76be1c672e +SHA512 (snapd_2.57.6.only-vendor.tar.xz) = 3d22aecd9d56a098c5033c51798b6dc7594aba9f5bfeea125c8faf8d5a078e6d4a2ae57f054b345b651efc37b86723b0b3964e1f07b7980c86ba028f0996d7fb From c8021827c4a4ac03efa59c25cc07bdac4f0e1975 Mon Sep 17 00:00:00 2001 From: Maciek Borzecki Date: Fri, 16 Dec 2022 08:31:14 +0100 Subject: [PATCH 07/44] snapd: build with no_openssl on RHEL7+ Build with no_openssl on RHEL7 and up. Fixes: RHBZ#2152903 Signed-off-by: Maciek Borzecki --- snapd.spec | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/snapd.spec b/snapd.spec index d917576..90474d9 100644 --- a/snapd.spec +++ b/snapd.spec @@ -83,7 +83,7 @@ Name: snapd Version: 2.57.6 -Release: 1%{?dist} +Release: 2%{?dist} Summary: A transactional software package manager License: GPLv3 URL: https://%{provider_prefix} @@ -515,8 +515,9 @@ BUILDTAGS="${BUILDTAGS} nomanagers" # To ensure things work correctly with base snaps, # snap-exec, snap-update-ns, and snapctl need to be built statically ( -%if 0%{?rhel} >= 8 - # since 1.12.1, the go-toolset module is built with FIPS compliance that +%if 0%{?rhel} >= 7 + # since RH Developer tools 2018.4 (and later releases), + # the go-toolset module is built with FIPS compliance that # defaults to using libcrypto.so which gets loaded at runtime via dlopen(), # disable that functionality for statically built binaries BUILDTAGS="${BUILDTAGS} no_openssl" @@ -936,7 +937,10 @@ fi %changelog -* Wed Nov 30 2022 Maciek Borzecki +* Fri Dec 16 2022 Maciek Borzecki - 2.57.6-2 +- Fix for RHBZ#2152903 + +* Wed Nov 30 2022 Maciek Borzecki - 2.57.6-1 - Release 2.57.6 to Fedora * Tue Nov 15 2022 Michael Vogt From 0881727d482173d265639b473b239cee9b2984b7 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 21 Jan 2023 03:35:22 +0000 Subject: [PATCH 08/44] Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- snapd.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/snapd.spec b/snapd.spec index 90474d9..5a4207d 100644 --- a/snapd.spec +++ b/snapd.spec @@ -83,7 +83,7 @@ Name: snapd Version: 2.57.6 -Release: 2%{?dist} +Release: 3%{?dist} Summary: A transactional software package manager License: GPLv3 URL: https://%{provider_prefix} @@ -937,6 +937,9 @@ fi %changelog +* Sat Jan 21 2023 Fedora Release Engineering - 2.57.6-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + * Fri Dec 16 2022 Maciek Borzecki - 2.57.6-2 - Fix for RHBZ#2152903 From 9afbaedf1b953a5a647da33038200a38b5861101 Mon Sep 17 00:00:00 2001 From: Maciek Borzecki Date: Sat, 25 Feb 2023 21:30:12 +0100 Subject: [PATCH 09/44] snapd: update to 2.58.3 Update to the latest release. Signed-off-by: Maciek Borzecki --- .gitignore | 2 + ...nfine-do-not-discard-const-qualifier.patch | 35 -- snapd.spec | 383 +++++++++++++++++- sources | 4 +- 4 files changed, 381 insertions(+), 43 deletions(-) delete mode 100644 0001-cmd-snap-confine-do-not-discard-const-qualifier.patch diff --git a/.gitignore b/.gitignore index 35b4bb8..ccd44c6 100644 --- a/.gitignore +++ b/.gitignore @@ -96,3 +96,5 @@ /snapd_2.57.5.only-vendor.tar.xz /snapd_2.57.6.no-vendor.tar.xz /snapd_2.57.6.only-vendor.tar.xz +/snapd_2.58.3.no-vendor.tar.xz +/snapd_2.58.3.only-vendor.tar.xz diff --git a/0001-cmd-snap-confine-do-not-discard-const-qualifier.patch b/0001-cmd-snap-confine-do-not-discard-const-qualifier.patch deleted file mode 100644 index 80f593f..0000000 --- a/0001-cmd-snap-confine-do-not-discard-const-qualifier.patch +++ /dev/null @@ -1,35 +0,0 @@ -From 51c27ea0c71a1737607b21bf9de3cc91cf690ebd Mon Sep 17 00:00:00 2001 -Message-Id: <51c27ea0c71a1737607b21bf9de3cc91cf690ebd.1669579092.git.maciek.borzecki@gmail.com> -From: Maciej Borzecki -Date: Sun, 27 Nov 2022 20:47:29 +0100 -Subject: [PATCH] cmd/snap-confine: do not discard const qualifier - -GCC 12.2.1 with the default build flags in Rawhide is more picky than usual, and -fails with this: - -snap-confine/selinux-support.c:85:29: error: initialization discards 'const' qualifier from pointer target type [-Werror=discarded-qualifiers] - 85 | char *new_ctx_str = context_str(ctx); - | ^~~~~~~~~~~ -cc1: all warnings being treated as errors - -Signed-off-by: Maciej Borzecki ---- - cmd/snap-confine/selinux-support.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/cmd/snap-confine/selinux-support.c b/cmd/snap-confine/selinux-support.c -index 344a3444b23d10afa408d2f1390156b44506ebc8..a65c02632968ac0f8f23d1bd4b7045a5206b59d9 100644 ---- a/cmd/snap-confine/selinux-support.c -+++ b/cmd/snap-confine/selinux-support.c -@@ -82,7 +82,7 @@ int sc_selinux_set_snap_execcon(void) { - } - - /* freed by context_free(ctx) */ -- char *new_ctx_str = context_str(ctx); -+ const char *new_ctx_str = context_str(ctx); - if (new_ctx_str == NULL) { - die("cannot obtain updated SELinux context string"); - } --- -2.38.1 - diff --git a/snapd.spec b/snapd.spec index 5a4207d..70b3652 100644 --- a/snapd.spec +++ b/snapd.spec @@ -52,7 +52,7 @@ %global provider_prefix %{provider}.%{provider_tld}/%{project}/%{repo} %global import_path %{provider_prefix} -%global snappy_svcs snapd.service snapd.socket snapd.autoimport.service snapd.seeded.service +%global snappy_svcs snapd.service snapd.socket snapd.autoimport.service snapd.seeded.service snapd.mounts.target snapd.mounts-pre.target %global snappy_user_svcs snapd.session-agent.service snapd.session-agent.socket # Until we have a way to add more extldflags to gobuild macro... @@ -80,17 +80,16 @@ %{!?_environmentdir: %global _environmentdir %{_prefix}/lib/environment.d} %{!?_systemdgeneratordir: %global _systemdgeneratordir %{_prefix}/lib/systemd/system-generators} %{!?_systemd_system_env_generator_dir: %global _systemd_system_env_generator_dir %{_prefix}/lib/systemd/system-environment-generators} +%{!?_tmpfilesdir: %global _tmpfilesdir %{_prefix}/lib/tmpfiles.d} Name: snapd -Version: 2.57.6 -Release: 3%{?dist} +Version: 2.58.3 +Release: 1%{?dist} Summary: A transactional software package manager License: GPLv3 URL: https://%{provider_prefix} Source0: https://%{provider_prefix}/releases/download/%{version}/%{name}_%{version}.no-vendor.tar.xz Source1: https://%{provider_prefix}/releases/download/%{version}/%{name}_%{version}.only-vendor.tar.xz -# FTBFS fix, submitted upstream https://github.com/snapcore/snapd/pull/12357 -Patch0: 0001-cmd-snap-confine-do-not-discard-const-qualifier.patch ExclusiveArch: %{?golang_arches}%{!?golang_arches:%{ix86} x86_64 %{arm} aarch64 ppc64le s390x} @@ -583,6 +582,7 @@ install -d -p %{buildroot}%{_mandir}/man8 install -d -p %{buildroot}%{_environmentdir} install -d -p %{buildroot}%{_systemdgeneratordir} install -d -p %{buildroot}%{_systemd_system_env_generator_dir} +install -d -p %{buildroot}%{_tmpfilesdir} install -d -p %{buildroot}%{_unitdir} install -d -p %{buildroot}%{_userunitdir} install -d -p %{buildroot}%{_sysconfdir}/profile.d @@ -785,6 +785,8 @@ popd %{_unitdir}/snapd.autoimport.service %{_unitdir}/snapd.failure.service %{_unitdir}/snapd.seeded.service +%{_unitdir}/snapd.mounts.target +%{_unitdir}/snapd.mounts-pre.target %{_userunitdir}/snapd.session-agent.service %{_userunitdir}/snapd.session-agent.socket %{_tmpfilesdir}/snapd.conf @@ -796,6 +798,7 @@ popd %{_datadir}/polkit-1/actions/io.snapcraft.snapd.policy %{_datadir}/applications/io.snapcraft.SessionAgent.desktop %{_datadir}/fish/vendor_conf.d/snapd.fish +%{_datadir}/snapd/snapcraft-logo-bird.svg %{_sysconfdir}/xdg/autostart/snap-userd-autostart.desktop %config(noreplace) %{_sysconfdir}/sysconfig/snapd %dir %{_sharedstatedir}/snapd @@ -937,18 +940,386 @@ fi %changelog +* Sat Feb 25 2023 Maciek Borzecki - 2.58.3-1 +- Releate 2.58.3 to Fedora RHBZ#2173056 + +* Tue Feb 21 2023 Michael Vogt +- New upstream release 2.58.3 + - interfaces/screen-inhibit-control: Add support for xfce-power- + manager + - interfaces/network-manager: do not show ptrace read + denials + - interfaces: relax rules for mount-control `what` for functionfs + - cmd/snap-bootstrap: add support for snapd_system_disk + - interfaces/modem-manager: add net_admin capability + - interfaces/network-manager: add permission for OpenVPN + - httputil: fix checking x509 certification error on go 1.20 + - i/b/fwupd: allow reading host os-release + - boot: on classic+modes `MarkBootSuccessfull` does not need a base + - boot: do not include `base=` in modeenv for classic+modes installs + - tests: add spread test that validates revert on boot for core does + not happen on classic+modes + - snapstate: only take boot participants into account in + UpdateBootRevisions + - snapstate: refactor UpdateBootRevisions() to make it easier to + check for boot.SnapTypeParticipatesInBoot() + +* Wed Jan 25 2023 Michael Vogt +- New upstream release 2.58.2 + - bootloader: fix dirty build by hardcoding copyright year + +* Mon Jan 23 2023 Michael Vogt +- New upstream release 2.58.1 + - secboot: detect lockout mode in CheckTPMKeySealingSupported + - cmd/snap-update-ns: prevent keeping unneeded mountpoints + - o/snapstate: do not infinitely retry when an update fails during + seeding + - interfaces/modem-manager: add permissions for NETLINK_ROUTE + - systemd/emulation.go: use `systemctl --root` to enable/disable + - snap: provide more error context in `NotSnapError` + - interfaces: add read access to /run for cryptsetup + - boot: avoid reboot loop if there is a bad try kernel + - devicestate: retry serial acquire on time based certificate + errors + - o/devicestate: run systemctl daemon-reload after install-device + hook + - cmd/snap,daemon: add 'held' to notes in 'snap list' + - o/snapshotstate: check snapshots are self-contained on import + - cmd/snap: show user+gating hold info in 'snap info' + - daemon: expose user and gating holds at /v2/snaps/{name} + * Sat Jan 21 2023 Fedora Release Engineering - 2.57.6-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild * Fri Dec 16 2022 Maciek Borzecki - 2.57.6-2 - Fix for RHBZ#2152903 +* Thu Dec 01 2022 Michael Vogt +- New upstream release 2.58 + - many: Use /tmp/snap-private-tmp for per-snap private tmps + - data: Add systemd-tmpfiles configuration to create private tmp dir + - cmd/snap: test allowed and forbidden refresh hold values + - cmd/snap: be more consistent in --hold help and err messages + - cmd/snap: error on refresh holds that are negative or too short + - o/homedirs: make sure we do not write to /var on build time + - image: make sure file customizations happen also when we have + defaultscause + - tests/fde-on-classic: set ubuntu-seed label in seed partitions + - gadget: system-seed-null should also have fs label ubuntu-seed + - many: gadget.HasRole, ubuntu-seed can come also from system-seed- + null + - o/devicestate: fix paths for retrieving recovery key on classic + - cmd/snap-confine: do not discard const qualifier + - interfaces: allow python3.10+ in the default template + - o/restart: fix PendingForSystemRestart + - interfaces: allow wayland slot snaps to access shm files created + by Firefox + - o/assertstate: add Sequence() to val set tracking + - o/assertstate: set val set 'Current' to pinned sequence + - tests: tweak the libvirt interface test to work on 22.10 + - tests: use system-seed-null role on classic with modes tests + - boot: add directory for data on install + - o/devicestate: change some names from esp to seed/seed-null + - gadget: add system-seed-null role + - o/devicestate: really add error to new error message + - restart,snapstate: implement reboot-required notifications on + classic + - many: avoid automatic system restarts on classic through new + overlord/restart logic + - release: Fix WSL detection in LXD + - o/state: introduce WaitStatus + - interfaces: Fix desktop interface rules for document portal + - client: remove classic check for `snap recovery --show- + keys` + - many: create snapd.mounts targets to schedule mount units + - image: enable sysfs overlay for UC preseeding + - i/b/network-control: add permissions for using AF_XDP + - i/apparmor: move mocking of home and overlay conditions to osutil + - tests/main/degraded: ignore man-db update failures in CentOS + - cmd/snap: fix panic when running snap w/ flag but w/o subcommand + - tests: save snaps generated during image preaparation + - tests: skip building snapd based on new env var + - client: remove misleading comments in ValidateApplyOptions + - boot/seal: add debug traces for bootchains + - bootloader/assets: fix grub.cfg when there are no labels + - cmd/snap: improve refresh hold's output + - packaging: enable BPF in RHEL9 + - packaging: do not traverse filesystems in postrm script + - tests: get microk8s from another branch + - bootloader: do not specify Core version in grub entry + - many: refresh --hold follow-up + - many: support refresh hold/unhold to API and CLI + - many: expand fully handling links mapping in all components, in + the API and in snap info + - snap/system_usernames,tests: Azure IoT Edge system usernames + - interface: Allow access to + org.freedesktop.DBus.ListActivatableNames via system-observe + interface + - o/devicestate,daemon: use the expiration date from the assertion + in user-state and REST api (user-removal 4/n) + - gadget: add unit tests for new install functions for FDE on + classic + - cmd/snap-seccomp: fix typo in AF_XDP value + - tests/connected-after-reboot-revert: run also on UC16 + - kvm: allow read of AMD-SEV parameters + - data: tweak apt integration config var + - o/c/configcore: add faillock configuration + - tests: use dbus-daemon instead of dbus-launch + - packaging: remove unclean debian-sid patch + - asserts: add keyword 'user-presence' keyword in system-user + assertion (auto-removal 3/n) + - interfaces: steam-support allow pivot /run/media and /etc/nvidia + mount + - aspects: initial code + - overlord: process auto-import assertion at first boot + - release, snapd-apparmor, syscheck: distinguish WSL1 and WSL2 + - tests: fix lxd-mount-units in ubuntu kinetic + - tests: new variable used to configure the kernel command line in + nested tests + - go.mod: update to newer secboot/uc22 branch + - autopkgtests: fix running autopkgtest on kinetic + - tests: remove squashfs leftovers in fakeinstaller + - tests: create partition table in fakeinstaller + - o/ifacestate: introduce DebugAutoConnectCheck hook + - tests: use test-snapd-swtpm instead of swtpm-mvo snap in nested + helper + - interfaces/polkit: do not require polkit directory if no file is + needed + - o/snapstate: be consistent not creating per-snap save dirs for + classic models + - inhibit: use hintFile() + - tests: use `snap prepare-image` in fde-on-classic mk-image.sh + - interfaces: add microceph interface + - seccomp: allow opening XDP sockets + - interfaces: allow access to icon subdirectories + - tests: add minimal-smoke test for UC22 and increase minimal RAM + - overlord: introduce hold levels in the snapstate.Hold* API + - o/devicestate: support mounting ubuntu-save also on classic with + modes + - interfaces: steam-support allow additional mounts + - fakeinstaller: format SystemDetails result with %+v + - cmd/libsnap-confine-private: do not panic on chmod failure + - tests: ensure that fakeinstaller put the seed into the right place + - many: add stub services for prompting + - tests: add libfwupd and libfwupdplugin5 to openSUSE dependencies + - o/snapstate: fix snaps-hold pruning/reset in the presence of + system holding + - many: add support for setting up encryption from installer + - many: support classic snaps in the context of classic and extended + models + - cmd/snap,daemon: allow zero values from client to daemon for + journal rate limit + - boot,o/devicestate: extend HasFDESetupHook to consider unrelated + kernels + - cmd/snap: validation set refresh-enforce CLI support + spread test + - many: fix filenames written in modeenv for base/gadget plus drive- + by TODO + - seed: fix seed test to use a pseudo-random byte sequence + - cmd/snap-confine: remove setuid calls from cgroup init code + - boot,o/devicestate: introduce and use MakeRunnableStandaloneSystem + - devicestate,boot,tests: make `fakeinstaller` test work + - store: send Snap-Device-Location header with cloud information + - overlord: fix unit tests after merging master in + - o/auth: move HasUserExpired into UserState and name it HasExpired, + and add unit tests for this + - o/auth: rename NewUserData to NewUserParams + - many: implementation of finish install step handlers + - overlord: auto-resolve validation set enforcement constraints + - i/backends,o/ifacestate: cleanup backends.All + - cmd/snap-confine: move bind-mount setup into separate function + - tests/main/mount-ns: update namespace for 18.04 + - o/state: Hold pseudo-error for explicit holding, concept of + pending changes in prune logic + - many: support extended classic models that omit kernel/gadget + - data/selinux: allow snapd to detect WSL + - overlord: add code to remove users that has an expiration date set + - wrappers,snap/quota: clear LogsDirectory= in the service unit for + journal namespaces + - daemon: move user add, remove operations to overlord device state + - gadget: implement write content from gadget information + - {device,snap}state: fix ineffectual assignments + - daemon: support validation set refresh+enforce in API + - many: rename AddAffected* to RegisterAffected*, add + Change|State.Has, fix a comment + - many: reset store session when setting proxy.store + - overlord/ifacestate: fix conflict detection of auto-connection + - interfaces: added read/write access to /proc/self/coredump_filter + for process-control + - interfaces: add read access to /proc/cgroups and + /proc/sys/vm/swappiness to system-observe + - fde: run fde-reveal-key with `DefaultDependencies=no` + - many: don't concatenate non-constant format strings + - o/devicestate: fix non-compiling test + - release, snapd-apparmor: fixed outdated WSL detection + - many: add todos discussed in the review in + tests/nested/manual/fde-on-classic, snapstate cleanups + - overlord: run install-device hook during factory reset + - i/b/mount-control: add optional `/` to umount rules + - gadget/install: split Run in several functions + - o/devicestate: refactor some methods as preparation for install + steps implementation + - tests: fix how snaps are cached in uc22 + - tests/main/cgroup-tracking-failure: fix rare failure in Xenial and + Bionic + - many: make {Install,Initramfs}{{,Host},Writable}Dir a function + - tests/nested/manual/core20: fix manual test after changes to + 'tests.nested exec' + - tests: move the unit tests system to 22.04 in github actions + workflow + - tests: fix nested errors uc20 + - boot: rewrite switch in SnapTypeParticipatesInBoot() + - gadget: refactor to allow usage from the installer + - overlord/devicestate: support for mounting ubuntu-save before the + install-device hook + - many: allow to install/update kernels/gadgets on classic with + modes + - tests: fix issues related to dbus session and localtime in uc18 + - many: support home dirs located deeper under /home + - many: refactor tests to use explicit strings instead of + boot.Install{Initramfs,Host}{Writable,FDEData}Dir + - boot: add factory-reset cases for boot-flags + - tests: disable quota tests on arm devices using ubuntu core + - tests: fix unbound SPREAD_PATH variable on nested debug session + - overlord: start turning restart into a full state manager + - boot: apply boot logic also for classic with modes boot snaps + - tests: fix snap-env test on debug section when no var files were + created + - overlord,daemon: allow returning errors when requesting a restart + - interfaces: login-session-control: add further D-Bus interfaces + - snapdenv: added wsl to userAgent + - o/snapstate: support running multiple ops transactionally + - store: use typed valset keys in store package + - daemon: add `ensureStateSoon()` when calling systems POST api + - gadget: add rules for validating classic with modes gadget.yaml + files + - wrappers: journal namespaces did not honor journal.persistent + - many: stub devicestate.Install{Finish,SetupStorageEncryption}() + - sandbox/cgroup: don't check V1 cgroup if V2 is active + - seed: add support to load auto import assertion + - tests: fix preseed tests for arm systems + - include/lk: update LK recovery environment definition to include + device lock state used by bootloader + - daemon: return `storage-encryption` in /systems/