From: Michael Vogt Date: Mon, 21 Aug 2023 07:59:54 +0000 (+0100) Subject: snapd (2.60.2-1) unstable; urgency=medium X-Git-Tag: archive/raspbian/2.68.3-3+rpi1^2^2^2^2^2^2^2^2^2^2^2^2^2^2~6 X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=d8077f8a497dd8cb5f8c229acc9c9bb8ed3c848e;p=snapd.git snapd (2.60.2-1) unstable; urgency=medium * New upstream release, LP: #2024007 - i/builtin: allow directories in private /dev/shm - i/builtin: add read access to /proc/task/schedstat in system- observe - snap-bootstrap: print version information at startup - go.mod: update gopkg.in/yaml.v3 to v3.0.1 to fix CVE-2022-28948 - snap, store: filter out invalid snap edited links from store info and persisted state - o/configcore: write netplan defaults to 00-snapd-config on seeding - snapcraft.yaml: pull in apparmor_parser optimization patches from https://gitlab.com/apparmor/apparmor/-/merge_requests/711 - snap-confine: fix missing \0 after readlink - cmd/snap: hide append-integrity-data - interfaces/opengl: add support for ARM Mali * debian/{control,rules}: - sync packaging changes from upstream [dgit import unpatched snapd 2.60.2-1] --- d8077f8a497dd8cb5f8c229acc9c9bb8ed3c848e diff --cc debian/README.Source index 00000000,00000000..2a4c1231 new file mode 100644 --- /dev/null +++ b/debian/README.Source @@@ -1,0 -1,0 +1,35 @@@ ++# Overview ++ ++The packaging is maintained in the upstream git repo at ++ ++github.com/snapcore/snapd in the packaging/debian-sid dir ++ ++Please push any debian changes back there to make packaging ++easier. ++ ++## Release a new version ++ ++To release a new upstream version the following steps are ++recommended: ++ ++ # one time setup ++ $ git clone git@salsa.debian.org:debian/snapd ++ $ cd snapd ++ $ git remote add upstream https://github.com/snapcore/snapd ++ ++ # releasing a new version ++ $ git fetch upstream ++ $ git merge upstream/ # e.g. upstream/2.44 ++ $ cp -ar packaging/debian-sid/* debian/ ++ # ensure to git add any new files ++ # set debian/changelog to UNRELEASED ++ $ git commit -a -m 'debian: sync packaging changes from upstream' ++ # update changelog ++ $ debcommit -ar ++ $ gbp buildpackage -S -d ++ # testbuild ++ $ pbuilder-dist sid update ++ $ pbuilder-dist sid build ../build-area/snapd_.dsc ++ $ dput ftp-master ../build-area/snapd__source.changes ++ ++ -- Michael Vogt , Wed, 18 Mar 2020 13:11:03 +0100 diff --cc debian/changelog index 00000000,00000000..8bf3a0cb new file mode 100644 --- /dev/null +++ b/debian/changelog @@@ -1,0 -1,0 +1,10183 @@@ ++snapd (2.60.2-1) unstable; urgency=medium ++ ++ * New upstream release, LP: #2024007 ++ - i/builtin: allow directories in private /dev/shm ++ - i/builtin: add read access to /proc/task/schedstat in system- ++ observe ++ - snap-bootstrap: print version information at startup ++ - go.mod: update gopkg.in/yaml.v3 to v3.0.1 to fix CVE-2022-28948 ++ - snap, store: filter out invalid snap edited links from store info ++ and persisted state ++ - o/configcore: write netplan defaults to 00-snapd-config on seeding ++ - snapcraft.yaml: pull in apparmor_parser optimization patches from ++ https://gitlab.com/apparmor/apparmor/-/merge_requests/711 ++ - snap-confine: fix missing \0 after readlink ++ - cmd/snap: hide append-integrity-data ++ - interfaces/opengl: add support for ARM Mali ++ * debian/{control,rules}: ++ - sync packaging changes from upstream ++ ++ -- Michael Vogt Mon, 21 Aug 2023 09:59:54 +0200 ++ ++snapd (2.60.1-1) unstable; urgency=medium ++ ++ * New upstream release, LP: #2024007 ++ - install: fallback to lazy unmount() in writeFilesystemContent ++ - data: include "modprobe.d" and "modules-load.d" in preseeded blob ++ - gadget: fix install test on armhf ++ - interfaces: fix typo in network_manager_observe ++ - sandbox/apparmor: don't let vendored apparmor conflict with system ++ - gadget/update: set parts in laid out data from the ones matched ++ - many: move SnapConfineAppArmorDir from dirs to sandbox/apparmor ++ - many: stop using `-O no-expr-simplify` in apparmor_parser ++ - go.mod: update secboot to latest uc22 branch ++ ++ -- Michael Vogt Tue, 04 Jul 2023 21:21:48 +0200 ++ ++snapd (2.60-1) unstable; urgency=medium ++ ++ * New upstream release, LP: #2024007 ++ - Support for dynamic snapshot data exclusions ++ - Apparmor userspace is vendored inside the snapd snap ++ - Added a default-configure hook that exposes gadget default ++ configuration options to snaps during first install before ++ services are started ++ - Allow install from initrd to speed up the initial installation ++ for systems that do not have a install-device hook ++ - New `snap sign --chain` flag that appends the account and ++ account-key assertions ++ - Support validation-sets in the model assertion ++ - Support new "min-size" field in gadget.yaml ++ - New interface: "userns" ++ ++ -- Michael Vogt Thu, 15 Jun 2023 17:14:31 +0200 ++ ++snapd (2.59.5-1) unstable; urgency=medium ++ ++ * New upstream release, LP: #2009946 ++ - Explicitly disallow the use of ioctl + TIOCLINUX ++ This fixes CVE-2023-1523. ++ * sync packaging changes from upstream ++ * d/p/0002-cmd-snap-seccomp-skip-tests-that-fail-on-4.19.patch, ++ d/p/0011-Fix-test-with-godbus-5.0.5.patch, ++ d/p/0015-fix-build-5bd97b39a03.patch, ++ d/p/0016-skip-TestPopulateFromSeedWithConnectHook.patch: ++ - dropped, no longer needed ++ ++ -- Michael Vogt Sat, 27 May 2023 16:17:59 +0200 ++ ++snapd (2.59.4-1) unstable; urgency=medium ++ ++ * New upstream release, LP: #2009946 ++ - Retry when looking for disk label on non-UEFI systems ++ (LP: #2018977) ++ - Fix remodel from UC20 to UC22 ++ ++ -- Michael Vogt Fri, 12 May 2023 10:15:57 +0200 ++ ++snapd (2.59.3-1) unstable; urgency=medium ++ ++ * New upstream release, LP: #2009946 ++ - Fix quiet boot ++ - i/b/physical_memory_observe: allow reading virt-phys page mappings ++ - gadget: warn instead of returning error if overlapping with GPT ++ header ++ - overlord,wrappers: restart always enabled units ++ - go.mod: update github.com/snapcore/secboot to latest uc22 ++ - boot: make sure we update assets for the system-seed-null role ++ - many: ignore case for vfat partitions when validating ++ ++ -- Michael Vogt Wed, 03 May 2023 12:31:00 +0200 ++ ++snapd (2.59.2-1) unstable; urgency=medium ++ ++ * New upstream release, LP: #2009946 ++ - Notify users when a user triggered auto refresh finished ++ ++ -- Michael Vogt Tue, 18 Apr 2023 19:46:10 +0200 ++ ++snapd (2.59.1-1) unstable; urgency=medium ++ ++ * New upstream release, LP: #2009946 ++ - Add udev rules from steam-devices to steam-support interface ++ - Bugfixes for layout path checking, dm_crypt permissions, ++ mount-control interface parameter checking, kernel commandline ++ parsing, docker-support, refresh-app-awareness ++ ++ -- Michael Vogt Tue, 28 Mar 2023 20:58:44 +0200 ++ ++snapd (2.59-1) unstable; urgency=medium ++ ++ * New upstream release, LP: #2009946 ++ - Support setting extra kernel command line parameters via snap ++ configuration and under a gadget allow-list ++ - Support for Full-Disk-Encryption using ICE ++ - Support for arbitrary home dir locations via snap configuration ++ - New nvidia-drivers-support interface ++ - Support for udisks2 snap ++ - Pre-download of snaps ready for refresh and automatic refresh of ++ the snap when all apps are closed ++ - New microovn interface ++ - Support uboot with `CONFIG_SYS_REDUNDAND_ENV=n` ++ - Make "snap-preseed --reset" re-exec when needed ++ - Update the fwupd interface to support fully confined fwupd ++ - The memory,cpu,thread quota options are no longer experimental ++ - Support debugging snap client requests via the ++ `SNAPD_CLIENT_DEBUG_HTTP` environment variable ++ - Support ssh listen-address via snap configuration ++ - Support for quotas on single services ++ - prepare-image now takes into account snapd versions going into ++ the image, including in the kernel initrd, to fetch supported ++ assertion formats ++ ++ -- Michael Vogt Fri, 10 Mar 2023 12:51:26 +0100 ++ ++snapd (2.58.3-1) unstable; urgency=medium ++ ++ * New upstream release, LP: #1998462 ++ - interfaces/screen-inhibit-control: Add support for xfce-power- ++ manager ++ - interfaces/network-manager: do not show ptrace read ++ denials ++ - interfaces: relax rules for mount-control `what` for functionfs ++ - cmd/snap-bootstrap: add support for snapd_system_disk ++ - interfaces/modem-manager: add net_admin capability ++ - interfaces/network-manager: add permission for OpenVPN ++ - httputil: fix checking x509 certification error on go 1.20 ++ - i/b/fwupd: allow reading host os-release ++ - boot: on classic+modes `MarkBootSuccessfull` does not need a base ++ - boot: do not include `base=` in modeenv for classic+modes installs ++ - tests: add spread test that validates revert on boot for core does ++ not happen on classic+modes ++ - snapstate: only take boot participants into account in ++ UpdateBootRevisions ++ - snapstate: refactor UpdateBootRevisions() to make it easier to ++ check for boot.SnapTypeParticipatesInBoot() ++ ++ -- Michael Vogt Tue, 21 Feb 2023 17:14:50 +0100 ++ ++snapd (2.58.2-1) unstable; urgency=medium ++ ++ * New upstream release, LP: #1998462 ++ - bootloader: fix dirty build by hardcoding copyright year ++ ++ -- Michael Vogt Wed, 25 Jan 2023 20:02:08 +0100 ++ ++snapd (2.58.1-1) unstable; urgency=medium ++ ++ * New upstream release, LP: #1998462 ++ - secboot: detect lockout mode in CheckTPMKeySealingSupported ++ - cmd/snap-update-ns: prevent keeping unneeded mountpoints ++ - o/snapstate: do not infinitely retry when an update fails during ++ seeding ++ - interfaces/modem-manager: add permissions for NETLINK_ROUTE ++ - systemd/emulation.go: use `systemctl --root` to enable/disable ++ - snap: provide more error context in `NotSnapError` ++ - interfaces: add read access to /run for cryptsetup ++ - boot: avoid reboot loop if there is a bad try kernel ++ - devicestate: retry serial acquire on time based certificate ++ errors ++ - o/devicestate: run systemctl daemon-reload after install-device ++ hook ++ - cmd/snap,daemon: add 'held' to notes in 'snap list' ++ - o/snapshotstate: check snapshots are self-contained on import ++ - cmd/snap: show user+gating hold info in 'snap info' ++ - daemon: expose user and gating holds at /v2/snaps/{name} ++ ++ -- Michael Vogt Mon, 23 Jan 2023 18:03:40 +0100 ++ ++snapd (2.58-1) unstable; urgency=medium ++ ++ * New upstream release, LP: #1998462 ++ - snap-confine: Fix race condition in snap-confine when preparing a ++ private tmp mount namespace for a snap (CVE-2022-3328) ++ - many: Use /tmp/snap-private-tmp for per-snap private tmps ++ - data: Add systemd-tmpfiles configuration to create private tmp dir ++ - cmd/snap: test allowed and forbidden refresh hold values ++ - cmd/snap: be more consistent in --hold help and err messages ++ - cmd/snap: error on refresh holds that are negative or too short ++ - o/homedirs: make sure we do not write to /var on build time ++ - image: make sure file customizations happen also when we have ++ defaultscause ++ - tests/fde-on-classic: set ubuntu-seed label in seed partitions ++ - gadget: system-seed-null should also have fs label ubuntu-seed ++ - many: gadget.HasRole, ubuntu-seed can come also from system-seed- ++ null ++ - o/devicestate: fix paths for retrieving recovery key on classic ++ - cmd/snap-confine: do not discard const qualifier ++ - interfaces: allow python3.10+ in the default template ++ - o/restart: fix PendingForSystemRestart ++ - interfaces: allow wayland slot snaps to access shm files created ++ by Firefox ++ - o/assertstate: add Sequence() to val set tracking ++ - o/assertstate: set val set 'Current' to pinned sequence ++ - tests: tweak the libvirt interface test to work on 22.10 ++ - tests: use system-seed-null role on classic with modes tests ++ - boot: add directory for data on install ++ - o/devicestate: change some names from esp to seed/seed-null ++ - gadget: add system-seed-null role ++ - o/devicestate: really add error to new error message ++ - restart,snapstate: implement reboot-required notifications on ++ classic ++ - many: avoid automatic system restarts on classic through new ++ overlord/restart logic ++ - release: Fix WSL detection in LXD ++ - o/state: introduce WaitStatus ++ - interfaces: Fix desktop interface rules for document portal ++ - client: remove classic check for `snap recovery --show- ++ keys` ++ - many: create snapd.mounts targets to schedule mount units ++ - image: enable sysfs overlay for UC preseeding ++ - i/b/network-control: add permissions for using AF_XDP ++ - i/apparmor: move mocking of home and overlay conditions to osutil ++ - tests/main/degraded: ignore man-db update failures in CentOS ++ - cmd/snap: fix panic when running snap w/ flag but w/o subcommand ++ - tests: save snaps generated during image preaparation ++ - tests: skip building snapd based on new env var ++ - client: remove misleading comments in ValidateApplyOptions ++ - boot/seal: add debug traces for bootchains ++ - bootloader/assets: fix grub.cfg when there are no labels ++ - cmd/snap: improve refresh hold's output ++ - packaging: enable BPF in RHEL9 ++ - packaging: do not traverse filesystems in postrm script ++ - tests: get microk8s from another branch ++ - bootloader: do not specify Core version in grub entry ++ - many: refresh --hold follow-up ++ - many: support refresh hold/unhold to API and CLI ++ - many: expand fully handling links mapping in all components, in ++ the API and in snap info ++ - snap/system_usernames,tests: Azure IoT Edge system usernames ++ - interface: Allow access to ++ org.freedesktop.DBus.ListActivatableNames via system-observe ++ interface ++ - o/devicestate,daemon: use the expiration date from the assertion ++ in user-state and REST api (user-removal 4/n) ++ - gadget: add unit tests for new install functions for FDE on ++ classic ++ - cmd/snap-seccomp: fix typo in AF_XDP value ++ - tests/connected-after-reboot-revert: run also on UC16 ++ - kvm: allow read of AMD-SEV parameters ++ - data: tweak apt integration config var ++ - o/c/configcore: add faillock configuration ++ - tests: use dbus-daemon instead of dbus-launch ++ - packaging: remove unclean debian-sid patch ++ - asserts: add keyword 'user-presence' keyword in system-user ++ assertion (auto-removal 3/n) ++ - interfaces: steam-support allow pivot /run/media and /etc/nvidia ++ mount ++ - aspects: initial code ++ - overlord: process auto-import assertion at first boot ++ - release, snapd-apparmor, syscheck: distinguish WSL1 and WSL2 ++ - tests: fix lxd-mount-units in ubuntu kinetic ++ - tests: new variable used to configure the kernel command line in ++ nested tests ++ - go.mod: update to newer secboot/uc22 branch ++ - autopkgtests: fix running autopkgtest on kinetic ++ - tests: remove squashfs leftovers in fakeinstaller ++ - tests: create partition table in fakeinstaller ++ - o/ifacestate: introduce DebugAutoConnectCheck hook ++ - tests: use test-snapd-swtpm instead of swtpm-mvo snap in nested ++ helper ++ - interfaces/polkit: do not require polkit directory if no file is ++ needed ++ - o/snapstate: be consistent not creating per-snap save dirs for ++ classic models ++ - inhibit: use hintFile() ++ - tests: use `snap prepare-image` in fde-on-classic mk-image.sh ++ - interfaces: add microceph interface ++ - seccomp: allow opening XDP sockets ++ - interfaces: allow access to icon subdirectories ++ - tests: add minimal-smoke test for UC22 and increase minimal RAM ++ - overlord: introduce hold levels in the snapstate.Hold* API ++ - o/devicestate: support mounting ubuntu-save also on classic with ++ modes ++ - interfaces: steam-support allow additional mounts ++ - fakeinstaller: format SystemDetails result with %+v ++ - cmd/libsnap-confine-private: do not panic on chmod failure ++ - tests: ensure that fakeinstaller put the seed into the right place ++ - many: add stub services for prompting ++ - tests: add libfwupd and libfwupdplugin5 to openSUSE dependencies ++ - o/snapstate: fix snaps-hold pruning/reset in the presence of ++ system holding ++ - many: add support for setting up encryption from installer ++ - many: support classic snaps in the context of classic and extended ++ models ++ - cmd/snap,daemon: allow zero values from client to daemon for ++ journal rate limit ++ - boot,o/devicestate: extend HasFDESetupHook to consider unrelated ++ kernels ++ - cmd/snap: validation set refresh-enforce CLI support + spread test ++ - many: fix filenames written in modeenv for base/gadget plus drive- ++ by TODO ++ - seed: fix seed test to use a pseudo-random byte sequence ++ - cmd/snap-confine: remove setuid calls from cgroup init code ++ - boot,o/devicestate: introduce and use MakeRunnableStandaloneSystem ++ - devicestate,boot,tests: make `fakeinstaller` test work ++ - store: send Snap-Device-Location header with cloud information ++ - overlord: fix unit tests after merging master in ++ - o/auth: move HasUserExpired into UserState and name it HasExpired, ++ and add unit tests for this ++ - o/auth: rename NewUserData to NewUserParams ++ - many: implementation of finish install step handlers ++ - overlord: auto-resolve validation set enforcement constraints ++ - i/backends,o/ifacestate: cleanup backends.All ++ - cmd/snap-confine: move bind-mount setup into separate function ++ - tests/main/mount-ns: update namespace for 18.04 ++ - o/state: Hold pseudo-error for explicit holding, concept of ++ pending changes in prune logic ++ - many: support extended classic models that omit kernel/gadget ++ - data/selinux: allow snapd to detect WSL ++ - overlord: add code to remove users that has an expiration date set ++ - wrappers,snap/quota: clear LogsDirectory= in the service unit for ++ journal namespaces ++ - daemon: move user add, remove operations to overlord device state ++ - gadget: implement write content from gadget information ++ - {device,snap}state: fix ineffectual assignments ++ - daemon: support validation set refresh+enforce in API ++ - many: rename AddAffected* to RegisterAffected*, add ++ Change|State.Has, fix a comment ++ - many: reset store session when setting proxy.store ++ - overlord/ifacestate: fix conflict detection of auto-connection ++ - interfaces: added read/write access to /proc/self/coredump_filter ++ for process-control ++ - interfaces: add read access to /proc/cgroups and ++ /proc/sys/vm/swappiness to system-observe ++ - fde: run fde-reveal-key with `DefaultDependencies=no` ++ - many: don't concatenate non-constant format strings ++ - o/devicestate: fix non-compiling test ++ - release, snapd-apparmor: fixed outdated WSL detection ++ - many: add todos discussed in the review in ++ tests/nested/manual/fde-on-classic, snapstate cleanups ++ - overlord: run install-device hook during factory reset ++ - i/b/mount-control: add optional `/` to umount rules ++ - gadget/install: split Run in several functions ++ - o/devicestate: refactor some methods as preparation for install ++ steps implementation ++ - tests: fix how snaps are cached in uc22 ++ - tests/main/cgroup-tracking-failure: fix rare failure in Xenial and ++ Bionic ++ - many: make {Install,Initramfs}{{,Host},Writable}Dir a function ++ - tests/nested/manual/core20: fix manual test after changes to ++ 'tests.nested exec' ++ - tests: move the unit tests system to 22.04 in github actions ++ workflow ++ - tests: fix nested errors uc20 ++ - boot: rewrite switch in SnapTypeParticipatesInBoot() ++ - gadget: refactor to allow usage from the installer ++ - overlord/devicestate: support for mounting ubuntu-save before the ++ install-device hook ++ - many: allow to install/update kernels/gadgets on classic with ++ modes ++ - tests: fix issues related to dbus session and localtime in uc18 ++ - many: support home dirs located deeper under /home ++ - many: refactor tests to use explicit strings instead of ++ boot.Install{Initramfs,Host}{Writable,FDEData}Dir ++ - boot: add factory-reset cases for boot-flags ++ - tests: disable quota tests on arm devices using ubuntu core ++ - tests: fix unbound SPREAD_PATH variable on nested debug session ++ - overlord: start turning restart into a full state manager ++ - boot: apply boot logic also for classic with modes boot snaps ++ - tests: fix snap-env test on debug section when no var files were ++ created ++ - overlord,daemon: allow returning errors when requesting a restart ++ - interfaces: login-session-control: add further D-Bus interfaces ++ - snapdenv: added wsl to userAgent ++ - o/snapstate: support running multiple ops transactionally ++ - store: use typed valset keys in store package ++ - daemon: add `ensureStateSoon()` when calling systems POST api ++ - gadget: add rules for validating classic with modes gadget.yaml ++ files ++ - wrappers: journal namespaces did not honor journal.persistent ++ - many: stub devicestate.Install{Finish,SetupStorageEncryption}() ++ - sandbox/cgroup: don't check V1 cgroup if V2 is active ++ - seed: add support to load auto import assertion ++ - tests: fix preseed tests for arm systems ++ - include/lk: update LK recovery environment definition to include ++ device lock state used by bootloader ++ - daemon: return `storage-encryption` in /systems/