[SRU] 2.48

The testing environment has changed from travis to github actions and the experience is still not entirely perfect. Michael kicked off a test run for the need of this SRU here:
https://github.com/snapcore/snapd/pull/9685

In the meantime I won't block on this and just proceed with the reviews. But let's keep an eye out for the tests to finish.

Hello Michael, or anyone else affected,

Accepted snapd into groovy-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/snapd/2.48+20.10 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-groovy to verification-done-groovy. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-groovy. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Hello Michael, or anyone else affected,

Accepted snapd into focal-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/snapd/2.48+20.04 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-focal to verification-done-focal. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-focal. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Hello Michael, or anyone else affected,

Accepted snapd into bionic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/snapd/2.48+18.04 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-bionic to verification-done-bionic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-bionic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Hello Michael, or anyone else affected,

Accepted snapd into xenial-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/snapd/2.48 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-xenial to verification-done-xenial. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-xenial. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

All autopkgtests for the newly accepted snapd (2.48) for xenial have finished running.
The following regressions have been reported in tests triggered by the package:

ubuntu-image/1.10+16.04ubuntu1 (amd64)

Please visit the excuses page listed below and investigate the failures, proceeding afterwards as per the StableReleaseUpdates policy regarding autopkgtest regressions [1].

https://people.canonical.com/~ubuntu-archive/proposed-migration/xenial/update_excuses.html#snapd

[1] https://wiki.ubuntu.com/StableReleaseUpdates#Autopkgtest_Regressions

Thank you!

All autopkgtests for the newly accepted snapd (2.48+20.04) for focal have finished running.
The following regressions have been reported in tests triggered by the package:

snapcraft/3.0ubuntu1 (ppc64el, arm64, amd64, s390x)

Please visit the excuses page listed below and investigate the failures, proceeding afterwards as per the StableReleaseUpdates policy regarding autopkgtest regressions [1].

https://people.canonical.com/~ubuntu-archive/proposed-migration/focal/update_excuses.html#snapd

[1] https://wiki.ubuntu.com/StableReleaseUpdates#Autopkgtest_Regressions

Thank you!

The travis runs are currently not active, we move to GH actions. The 2.48 release test run is visible at https://github.com/snapcore/snapd/pull/9685/checks?check_run_id=1443415116

Some isolated test failures on centos/suse but Ubuntu is all green. One small issue on ubuntu-core-20 with the fsck test which happens because of a change in the gadget and the fix for that will be part of 2.48.1 (it's harmless, really just affects the test, no real functionality).

The SRU validation is completed and approved.
Test results: https://trello.com/c/6NyUmAhC/753-snapd-248

This bug was fixed in the package snapd - 2.48+21.04

---------------
snapd (2.48+21.04) hirsute; urgency=medium

  * New upstream release, LP: #1904098
    - osutil: add KernelCommandLineKeyValue
    - devicestate: implement boot.HasFDESetupHook
    - boot/makebootable.go: set snapd_recovery_mode=install at image-
      build time
    - bootloader: use ForGadget when installing boot config
    - interfaces/raw_usb: allow read access to /proc/tty/drivers
    - boot: add scaffolding for "fde-setup" hook support for sealing
    - tests: fix basic20 test on arm devices
    - seed: make a shared seed system label validation helper
    - snap: add new "fde-setup" hooktype
    - cmd/snap-bootstrap, secboot, tests: misc cleanups, add spread test
    - secboot,cmd/snap-bootstrap: fix degraded mode cases with better
      device handling
    - boot,dirs,c/snap-bootstrap: avoid InstallHost* at the cost of some
      messiness
    - tests/nested/manual/refresh-revert-fundamentals: temporarily
      disable secure boot
    - snap-bootstrap,secboot: call BlockPCRProtectionPolicies in all
      boot modes
    - many: address degraded recover mode feedback, cleanups
    - tests: Use systemd-run on tests part2
    - tests: set the opensuse tumbleweed system as manual in spread.yaml
    - secboot: call BlockPCRProtectionPolicies even if the TPM is
      disabled
    - vendor: update to current secboot
    - cmd/snap-bootstrap,o/devicestate: use a secret to pair data and
      save
    - spread.yaml: increase number of workers on 20.10
    - snap: add new `snap recovery --show-keys` option
    - tests: minor test tweaks suggested in the review of 9607
    - snapd-generator: set standard snapfuse options when generating
      units for containers
    - tests: enable lxd test on ubuntu-core-20 and 16.04-32
    - interfaces: share /tmp/.X11-unix/ from host or provider
    - tests: enable main lxd test on 20.10
    - cmd/s-b/initramfs-mounts: refactor recover mode to implement
      degraded mode
    - gadget/install: add progress logging
    - packaging: keep secboot/encrypt_dummy.go in debian
    - interfaces/udev: use distro specific path to snap-device-helper
    - o/devistate: fix chaining of tasks related to regular snaps when
      preseeding
    - gadget, overlord/devicestate: validate that system supports
      encrypted data before install
    - interfaces/fwupd: enforce the confined fwupd to align Ubuntu Core
      ESP layout
    - many: add /v2/system-recovery-keys API and client
    - secboot, many: return UnlockMethod from Unlock* methods for future
      usage
    - many: mv keys to ubuntu-boot, move model file, rename keyring
      prefix for secboot
    - tests: using systemd-run instead of manually create a systemd unit
      - part 1
    - secboot, cmd/snap-bootstrap: enable or disable activation with
      recovery key
    - secboot: refactor Unlock...IfEncrypted to take keyfile + check
      disks first
    - secboot: add LockTPMSealedKeys() to lock access to keys
      independently
    - gadget: correct sfdisk arguments
    - bootloader/assets/grub: adjust fwsetup menuentry label
    - tests: new boot state tool
    - spread: use the officia...

This bug was fixed in the package snapd - 2.48+20.10

---------------
snapd (2.48+20.10) groovy; urgency=medium

  * New upstream release, LP: #1904098
    - osutil: add KernelCommandLineKeyValue
    - devicestate: implement boot.HasFDESetupHook
    - boot/makebootable.go: set snapd_recovery_mode=install at image-
      build time
    - bootloader: use ForGadget when installing boot config
    - interfaces/raw_usb: allow read access to /proc/tty/drivers
    - boot: add scaffolding for "fde-setup" hook support for sealing
    - tests: fix basic20 test on arm devices
    - seed: make a shared seed system label validation helper
    - snap: add new "fde-setup" hooktype
    - cmd/snap-bootstrap, secboot, tests: misc cleanups, add spread test
    - secboot,cmd/snap-bootstrap: fix degraded mode cases with better
      device handling
    - boot,dirs,c/snap-bootstrap: avoid InstallHost* at the cost of some
      messiness
    - tests/nested/manual/refresh-revert-fundamentals: temporarily
      disable secure boot
    - snap-bootstrap,secboot: call BlockPCRProtectionPolicies in all
      boot modes
    - many: address degraded recover mode feedback, cleanups
    - tests: Use systemd-run on tests part2
    - tests: set the opensuse tumbleweed system as manual in spread.yaml
    - secboot: call BlockPCRProtectionPolicies even if the TPM is
      disabled
    - vendor: update to current secboot
    - cmd/snap-bootstrap,o/devicestate: use a secret to pair data and
      save
    - spread.yaml: increase number of workers on 20.10
    - snap: add new `snap recovery --show-keys` option
    - tests: minor test tweaks suggested in the review of 9607
    - snapd-generator: set standard snapfuse options when generating
      units for containers
    - tests: enable lxd test on ubuntu-core-20 and 16.04-32
    - interfaces: share /tmp/.X11-unix/ from host or provider
    - tests: enable main lxd test on 20.10
    - cmd/s-b/initramfs-mounts: refactor recover mode to implement
      degraded mode
    - gadget/install: add progress logging
    - packaging: keep secboot/encrypt_dummy.go in debian
    - interfaces/udev: use distro specific path to snap-device-helper
    - o/devistate: fix chaining of tasks related to regular snaps when
      preseeding
    - gadget, overlord/devicestate: validate that system supports
      encrypted data before install
    - interfaces/fwupd: enforce the confined fwupd to align Ubuntu Core
      ESP layout
    - many: add /v2/system-recovery-keys API and client
    - secboot, many: return UnlockMethod from Unlock* methods for future
      usage
    - many: mv keys to ubuntu-boot, move model file, rename keyring
      prefix for secboot
    - tests: using systemd-run instead of manually create a systemd unit
      - part 1
    - secboot, cmd/snap-bootstrap: enable or disable activation with
      recovery key
    - secboot: refactor Unlock...IfEncrypted to take keyfile + check
      disks first
    - secboot: add LockTPMSealedKeys() to lock access to keys
      independently
    - gadget: correct sfdisk arguments
    - bootloader/assets/grub: adjust fwsetup menuentry label
    - tests: new boot state tool
    - spread: use the official...

The verification of the Stable Release Update for snapd has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

Hello!

Thanks for maintaining snapd packages!

I recently got an upgrade of snapd on Ubuntu 20.10 Hirsute. I only use it for Chromium, mainly to attend some meetings. Chromium had been updated 12 days ago according to 'snap info'. It has been restarted since then. "lxd" has not been upgraded recently.

After the upgrade, my microphone was not accepted in a meeting. I restarted chromium but nothing happened: it didn't restart. I quickly checked with "ps" and there was one process started and related to chromium: /snap/bin/chromium. Relaunching Chromium added one process like that.

I also did: "snap list" but nothing was printed and it looked stuck, I didn't get the prompt back.

Sadly, I didn't have time to investigate more because I was expected in a meeting so I did a Windows (reboot) and after it was OK. I didn't try to restart snapd services :-/

After the reboot (and the meeting), I tried to collect more logs:

 $ journalctl -u snapd -b-1
(...)
Nov 29 21:26:46 me snapd[974]: storehelpers.go:551: cannot refresh: snap has no updates available: "chromium", "core", "core18", "core20", "gtk-common-themes" (...)
Nov 30 10:43:48 me systemd[1]: Stopping Snap Daemon...
Nov 30 10:43:48 me snapd[974]: main.go:155: Exiting on terminated signal.
Nov 30 10:44:13 me snapd[974]: daemon.go:586: WARNING: cannot gracefully shut down in-flight snapd API activity within: 25s
Nov 30 10:45:18 me systemd[1]: snapd.service: State 'stop-sigterm' timed out. Killing.
Nov 30 10:45:18 me systemd[1]: snapd.service: Killing process 974 (snapd) with signal SIGKILL.
Nov 30 10:45:18 me systemd[1]: snapd.service: Main process exited, code=killed, status=9/KILL
Nov 30 10:45:18 me systemd[1]: snapd.service: Failed with result 'timeout'.
Nov 30 10:45:18 me systemd[1]: Stopped Snap Daemon.
Nov 30 10:45:18 me systemd[1]: snapd.service: Triggering OnFailure= dependencies.

 $ journalctl -u snapd.apparmor -b-1
-- Logs begin at Mon 2020-10-12 09:26:32 CEST, end at Mon 2020-11-30 12:08:22 CET. --
Nov 27 10:41:38 me systemd[1]: Starting Load AppArmor profiles managed internally by snapd...
Nov 27 10:41:38 me systemd[1]: Finished Load AppArmor profiles managed internally by snapd.
Nov 30 10:43:48 me systemd[1]: snapd.apparmor.service: Succeeded.
Nov 30 10:43:48 me systemd[1]: Stopped Load AppArmor profiles managed internally by snapd.

 $ journalctl -u snapd.seeded.service -b-1
-- Logs begin at Mon 2020-10-12 09:26:32 CEST, end at Mon 2020-11-30 12:08:52 CET. --
Nov 27 10:41:39 me systemd[1]: Starting Wait until snapd is fully seeded...
Nov 27 10:41:39 me systemd[1]: Finished Wait until snapd is fully seeded.
Nov 30 10:43:48 me systemd[1]: snapd.seeded.service: Succeeded.
Nov 30 10:43:48 me systemd[1]: Stopped Wait until snapd is fully seeded.

 $ journalctl -u snapd.failure -b-1
-- Logs begin at Mon 2020-10-12 09:26:32 CEST, end at Mon 2020-11-30 12:08:52 CET. --
Nov 30 10:45:18 me systemd[1]: Starting Failure handling of the snapd snap...
Nov 30 10:45:18 me systemd[1]: snapd.failure.service: Succeeded.
Nov 30 10:45:18 me systemd[1]: Finished Failure handling of the snapd snap.

Not sure it would help. I didn't find any logs related to snapd in /var/log.

Hello again,

I just noticed that because of another bug -- bug 1906245 -- my system didn't finish the upgrade and I probably missed the post install steps.

I guess my previous comment can be discarded, sorry for the noise!

This bug was fixed in the package snapd - 2.48+20.04

---------------
snapd (2.48+20.04) focal; urgency=medium

  * New upstream release, LP: #1904098
    - osutil: add KernelCommandLineKeyValue
    - devicestate: implement boot.HasFDESetupHook
    - boot/makebootable.go: set snapd_recovery_mode=install at image-
      build time
    - bootloader: use ForGadget when installing boot config
    - interfaces/raw_usb: allow read access to /proc/tty/drivers
    - boot: add scaffolding for "fde-setup" hook support for sealing
    - tests: fix basic20 test on arm devices
    - seed: make a shared seed system label validation helper
    - snap: add new "fde-setup" hooktype
    - cmd/snap-bootstrap, secboot, tests: misc cleanups, add spread test
    - secboot,cmd/snap-bootstrap: fix degraded mode cases with better
      device handling
    - boot,dirs,c/snap-bootstrap: avoid InstallHost* at the cost of some
      messiness
    - tests/nested/manual/refresh-revert-fundamentals: temporarily
      disable secure boot
    - snap-bootstrap,secboot: call BlockPCRProtectionPolicies in all
      boot modes
    - many: address degraded recover mode feedback, cleanups
    - tests: Use systemd-run on tests part2
    - tests: set the opensuse tumbleweed system as manual in spread.yaml
    - secboot: call BlockPCRProtectionPolicies even if the TPM is
      disabled
    - vendor: update to current secboot
    - cmd/snap-bootstrap,o/devicestate: use a secret to pair data and
      save
    - spread.yaml: increase number of workers on 20.10
    - snap: add new `snap recovery --show-keys` option
    - tests: minor test tweaks suggested in the review of 9607
    - snapd-generator: set standard snapfuse options when generating
      units for containers
    - tests: enable lxd test on ubuntu-core-20 and 16.04-32
    - interfaces: share /tmp/.X11-unix/ from host or provider
    - tests: enable main lxd test on 20.10
    - cmd/s-b/initramfs-mounts: refactor recover mode to implement
      degraded mode
    - gadget/install: add progress logging
    - packaging: keep secboot/encrypt_dummy.go in debian
    - interfaces/udev: use distro specific path to snap-device-helper
    - o/devistate: fix chaining of tasks related to regular snaps when
      preseeding
    - gadget, overlord/devicestate: validate that system supports
      encrypted data before install
    - interfaces/fwupd: enforce the confined fwupd to align Ubuntu Core
      ESP layout
    - many: add /v2/system-recovery-keys API and client
    - secboot, many: return UnlockMethod from Unlock* methods for future
      usage
    - many: mv keys to ubuntu-boot, move model file, rename keyring
      prefix for secboot
    - tests: using systemd-run instead of manually create a systemd unit
      - part 1
    - secboot, cmd/snap-bootstrap: enable or disable activation with
      recovery key
    - secboot: refactor Unlock...IfEncrypted to take keyfile + check
      disks first
    - secboot: add LockTPMSealedKeys() to lock access to keys
      independently
    - gadget: correct sfdisk arguments
    - bootloader/assets/grub: adjust fwsetup menuentry label
    - tests: new boot state tool
    - spread: use the official ...

This bug was fixed in the package snapd - 2.48+18.04

---------------
snapd (2.48+18.04) bionic; urgency=medium

  * New upstream release, LP: #1904098
    - osutil: add KernelCommandLineKeyValue
    - devicestate: implement boot.HasFDESetupHook
    - boot/makebootable.go: set snapd_recovery_mode=install at image-
      build time
    - bootloader: use ForGadget when installing boot config
    - interfaces/raw_usb: allow read access to /proc/tty/drivers
    - boot: add scaffolding for "fde-setup" hook support for sealing
    - tests: fix basic20 test on arm devices
    - seed: make a shared seed system label validation helper
    - snap: add new "fde-setup" hooktype
    - cmd/snap-bootstrap, secboot, tests: misc cleanups, add spread test
    - secboot,cmd/snap-bootstrap: fix degraded mode cases with better
      device handling
    - boot,dirs,c/snap-bootstrap: avoid InstallHost* at the cost of some
      messiness
    - tests/nested/manual/refresh-revert-fundamentals: temporarily
      disable secure boot
    - snap-bootstrap,secboot: call BlockPCRProtectionPolicies in all
      boot modes
    - many: address degraded recover mode feedback, cleanups
    - tests: Use systemd-run on tests part2
    - tests: set the opensuse tumbleweed system as manual in spread.yaml
    - secboot: call BlockPCRProtectionPolicies even if the TPM is
      disabled
    - vendor: update to current secboot
    - cmd/snap-bootstrap,o/devicestate: use a secret to pair data and
      save
    - spread.yaml: increase number of workers on 20.10
    - snap: add new `snap recovery --show-keys` option
    - tests: minor test tweaks suggested in the review of 9607
    - snapd-generator: set standard snapfuse options when generating
      units for containers
    - tests: enable lxd test on ubuntu-core-20 and 16.04-32
    - interfaces: share /tmp/.X11-unix/ from host or provider
    - tests: enable main lxd test on 20.10
    - cmd/s-b/initramfs-mounts: refactor recover mode to implement
      degraded mode
    - gadget/install: add progress logging
    - packaging: keep secboot/encrypt_dummy.go in debian
    - interfaces/udev: use distro specific path to snap-device-helper
    - o/devistate: fix chaining of tasks related to regular snaps when
      preseeding
    - gadget, overlord/devicestate: validate that system supports
      encrypted data before install
    - interfaces/fwupd: enforce the confined fwupd to align Ubuntu Core
      ESP layout
    - many: add /v2/system-recovery-keys API and client
    - secboot, many: return UnlockMethod from Unlock* methods for future
      usage
    - many: mv keys to ubuntu-boot, move model file, rename keyring
      prefix for secboot
    - tests: using systemd-run instead of manually create a systemd unit
      - part 1
    - secboot, cmd/snap-bootstrap: enable or disable activation with
      recovery key
    - secboot: refactor Unlock...IfEncrypted to take keyfile + check
      disks first
    - secboot: add LockTPMSealedKeys() to lock access to keys
      independently
    - gadget: correct sfdisk arguments
    - bootloader/assets/grub: adjust fwsetup menuentry label
    - tests: new boot state tool
    - spread: use the official...

This bug was fixed in the package snapd - 2.48

---------------
snapd (2.48) xenial; urgency=medium

  * New upstream release, LP: #1904098
    - osutil: add KernelCommandLineKeyValue
    - devicestate: implement boot.HasFDESetupHook
    - boot/makebootable.go: set snapd_recovery_mode=install at image-
      build time
    - bootloader: use ForGadget when installing boot config
    - interfaces/raw_usb: allow read access to /proc/tty/drivers
    - boot: add scaffolding for "fde-setup" hook support for sealing
    - tests: fix basic20 test on arm devices
    - seed: make a shared seed system label validation helper
    - snap: add new "fde-setup" hooktype
    - cmd/snap-bootstrap, secboot, tests: misc cleanups, add spread test
    - secboot,cmd/snap-bootstrap: fix degraded mode cases with better
      device handling
    - boot,dirs,c/snap-bootstrap: avoid InstallHost* at the cost of some
      messiness
    - tests/nested/manual/refresh-revert-fundamentals: temporarily
      disable secure boot
    - snap-bootstrap,secboot: call BlockPCRProtectionPolicies in all
      boot modes
    - many: address degraded recover mode feedback, cleanups
    - tests: Use systemd-run on tests part2
    - tests: set the opensuse tumbleweed system as manual in spread.yaml
    - secboot: call BlockPCRProtectionPolicies even if the TPM is
      disabled
    - vendor: update to current secboot
    - cmd/snap-bootstrap,o/devicestate: use a secret to pair data and
      save
    - spread.yaml: increase number of workers on 20.10
    - snap: add new `snap recovery --show-keys` option
    - tests: minor test tweaks suggested in the review of 9607
    - snapd-generator: set standard snapfuse options when generating
      units for containers
    - tests: enable lxd test on ubuntu-core-20 and 16.04-32
    - interfaces: share /tmp/.X11-unix/ from host or provider
    - tests: enable main lxd test on 20.10
    - cmd/s-b/initramfs-mounts: refactor recover mode to implement
      degraded mode
    - gadget/install: add progress logging
    - packaging: keep secboot/encrypt_dummy.go in debian
    - interfaces/udev: use distro specific path to snap-device-helper
    - o/devistate: fix chaining of tasks related to regular snaps when
      preseeding
    - gadget, overlord/devicestate: validate that system supports
      encrypted data before install
    - interfaces/fwupd: enforce the confined fwupd to align Ubuntu Core
      ESP layout
    - many: add /v2/system-recovery-keys API and client
    - secboot, many: return UnlockMethod from Unlock* methods for future
      usage
    - many: mv keys to ubuntu-boot, move model file, rename keyring
      prefix for secboot
    - tests: using systemd-run instead of manually create a systemd unit
      - part 1
    - secboot, cmd/snap-bootstrap: enable or disable activation with
      recovery key
    - secboot: refactor Unlock...IfEncrypted to take keyfile + check
      disks first
    - secboot: add LockTPMSealedKeys() to lock access to keys
      independently
    - gadget: correct sfdisk arguments
    - bootloader/assets/grub: adjust fwsetup menuentry label
    - tests: new boot state tool
    - spread: use the official image for U...